From 1a6698724557c835a5c5e62c0d76b5af37faaf5e Mon Sep 17 00:00:00 2001
From: Jonathan Kelley <jkelleyrtp@gmail.com>
Date: Fri, 26 Jul 2024 16:29:24 -0700
Subject: [PATCH] Fix: enable dangerous_inner_html for svgs (#2717)

---
 examples/rsx_usage.rs                 | 6 ++++++
 packages/html/src/attribute_groups.rs | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/examples/rsx_usage.rs b/examples/rsx_usage.rs
index 399b516c8..3bffe8c70 100644
--- a/examples/rsx_usage.rs
+++ b/examples/rsx_usage.rs
@@ -95,6 +95,12 @@ fn app() -> Element {
                     }
                 }
             }
+
+            // dangerous_inner_html for both html and svg
+            div { dangerous_inner_html: "<p>hello dangerous inner html</p>" }
+            svg { dangerous_inner_html: "<circle r='50' cx='50' cy='50' />" }
+
+            // Built-in idents can be used
             use {}
             link {
                 as: "asd"
diff --git a/packages/html/src/attribute_groups.rs b/packages/html/src/attribute_groups.rs
index 8ec00f20f..e46a03d32 100644
--- a/packages/html/src/attribute_groups.rs
+++ b/packages/html/src/attribute_groups.rs
@@ -1752,6 +1752,12 @@ mod_methods! {
     /// <https://developer.mozilla.org/en-US/docs/Web/API/Event/preventDefault>
     prevent_default: "dioxus-prevent-default";
 
+    /// dangerous_inner_html is Dioxus's replacement for using innerHTML in the browser DOM. In general, setting
+    /// HTML from code is risky because it’s easy to inadvertently expose your users to a cross-site scripting (XSS)
+    /// attack. So, you can set HTML directly from Dioxus, but you have to type out dangerous_inner_html to remind
+    /// yourself that it’s dangerous
+    dangerous_inner_html;
+
     /// <https://developer.mozilla.org/en-US/docs/Web/SVG/Attribute/accent-height>
     accent_height: "accent-height";