I'm creating a note app where users can add a note by entering multiline text in a textarea. When I save the note in Firebase it is being saved with newline (\n) characters which I want to visualize.
Therefore, I wrote a filter that replaces these characters with <br />
and that works great.
Though, now I need to render my data using {{{note.content}}}
and a user can inject HTML, CSS, and JS that will be executed.
Should I use something like DOMPurify to validate the content or is there a way to safely render newline characters?
As @shelvacu said the <pre>
html tag preserves whitespaces.
However using it has one serious disadvantage: the tag itself inherits plenty of unnecessary styling from CSS frameworks that are used in project (e.g. Bootstrap).
To preserve whitespaces and avoid inheriting any unnecessary styles use:
<span style="white-space: pre;">Some whitespaced content</span>
what will act exacly like the <pre>
tag.
Be aware that white-space: pre
remains text 'as it is' - if you would like to have additional line break when it's necessary use: white-space: pre-wrap
.
See: w3schools.com CSS white-space Property
pre
element.A <pre>
element will preserve whitespace within it, eg:
This is followed by a newline, not that you can tell <br /> <br /> <pre>You can see the newline after me! Woohoo!</pre>
Will result in:
This is followed by a newline, not that you can tell You can see the newline after me! Woohoo!
This way, you do not need to do any filtering of newlines.
Use white-space: pre-line;
CSS property.
As write in Mozzila Doc for pre-line
value:
Sequences of white space are collapsed. Lines are broken at newline characters, at
<br>
, and as necessary to fill line boxes.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With