btcpayserver/BTCPayServer/Views/Shared/PosData.cshtml
Nicolas Dorier 7b5ce8f70c
CSP: Remove unsafe-eval when vue isn't used (#4747)
* CSP: Remove unsafe-eval when vue isn't used

* Prevent XSS injection via VueJS
2023-03-08 17:57:36 +09:00

64 lines
1.9 KiB
Text

@model (Dictionary<string, object> Items, int Level)
@functions {
private bool IsValidURL(string source)
{
return Uri.TryCreate(source, UriKind.Absolute, out var uriResult) &&
(uriResult.Scheme == Uri.UriSchemeHttp || uriResult.Scheme == Uri.UriSchemeHttps);
}
}
<table class="table my-0" v-pre>
@foreach (var (key, value) in Model.Items)
{
<tr>
@if (value is string str)
{
if (!string.IsNullOrEmpty(key))
{
<th class="w-150px">@key</th>
}
<td>
@if (IsValidURL(str))
{
<a href="@str" target="_blank" rel="noreferrer noopener">@str</a>
}
else
{
@value?.ToString()
}
</td>
}
else if (value is Dictionary<string, object>subItems)
{
@* This is the array case *@
if (subItems.Count == 1 && subItems.First().Value is string str2)
{
<th class="w-150px">@key</th>
<td>
@if (IsValidURL(str2))
{
<a href="@str2" target="_blank" rel="noreferrer noopener">@str2</a>
}
else
{
@subItems.First().Value?.ToString()
}
</td>
}
else
{
<td colspan="2" >
@{
Write(Html.Raw($"<h{Model.Level + 3} class=\"mt-4 mb-3\">"));
Write(key);
Write(Html.Raw($"</h{Model.Level + 3}>"));
}
<partial name="PosData" model="(subItems, Model.Level + 1)"/>
</td>
}
}
</tr>
}
</table>