fix(runtime-vapor): setting innerHTML should go through trusted types (#14000)

edison1105 · web-flow · commit a3453e31da62 · 2025-10-21T08:31:35.000+08:00
diff --git a/packages/runtime-vapor/src/dom/prop.ts b/packages/runtime-vapor/src/dom/prop.ts
@@ -381,7 +381,7 @@ export function setBlockHtml(
   block: Block & { $html?: string },
   value: any,
 ): void {
-  value = value == null ? '' : value
+  value = value == null ? '' : unsafeToTrustedHTML(value)
   if (block.$html !== value) {
     setHtmlToBlock(block, (block.$html = value))
   }

Original file line number	Diff line number	Diff line change
`@@ -381,7 +381,7 @@ export function setBlockHtml(`
`381`	`381`	`block: Block & { $html?: string },`
`382`	`382`	`value: any,`
`383`	`383`	`): void {`
`384`		`- value = value == null ? '' : value`
	`384`	`+ value = value == null ? '' : unsafeToTrustedHTML(value)`
`385`	`385`	`if (block.$html !== value) {`
`386`	`386`	`setHtmlToBlock(block, (block.$html = value))`
`387`	`387`	`}`