ayo/lion
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(form-core): remove possible untrusted input value callback

Browse source
This commit is contained in:
qa46hx 2020-07-16 15:02:51 +02:00
parent 8396888699
commit e06196dec8
1 changed files with 7 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
packages/form-core/src/LionField.js
View file

@ -41,6 +41,9 @@ export class LionField extends FormControlMixin(
type: String,
reflect: true,
},
value: {
type: String,
},
};
}
@ -79,11 +82,14 @@ export class LionField extends FormControlMixin(
// if not yet connected to dom can't change the value
if (this._inputNode) {
this._setValueAndPreserveCaret(value);
this.__value = undefined;
} else {
this.__value = value;
}
}
get value() {
return (this._inputNode && this._inputNode.value) || '';
return (this._inputNode && this._inputNode.value) || this.__value || '';
}
constructor() {
@ -98,13 +104,6 @@ export class LionField extends FormControlMixin(
}
connectedCallback() {
// TODO: Investigate issue below.
// Normally we put super calls on top for predictability,
// here we temporarily need to do attribute delegation before,
// so the FormatMixin uses the right value. Should be solved
// when value delegation is part of the calculation loop of
// FormatMixin
this._delegateInitialValueAttr();
super.connectedCallback();
this._onChange = this._onChange.bind(this);
this._inputNode.addEventListener('change', this._onChange);
@ -133,17 +132,6 @@ export class LionField extends FormControlMixin(
}
}
/**
* This is not done via 'get delegations', because this._inputNode.setAttribute('value')
* does not trigger a value change
*/
_delegateInitialValueAttr() {
const valueAttr = this.getAttribute('value');
if (valueAttr !== null) {
this.value = valueAttr;
}
}
resetInteractionState() {
if (super.resetInteractionState) {
super.resetInteractionState();