Help Center/ Huawei Cloud Astro Canvas/ User Guide/ Custom Widget Development Specifications/ Widget Built-in APIs/ Preset APIs of the SafeUtils Security Tool Class
Updated on 2025-03-24 GMT+08:00
View PDF
Share

Preset APIs of the SafeUtils Security Tool Class

Table 1 Preset APIs of the SafeUtils security tool class

API

Description

escapeHtml()

Escapes HTML character strings.

getSafeUrl()

Perform XSS security filtering on external links to obtain secure absolute URLs.

escapeHtml()

Escape the HTML character string and obtain the escaped character string for display on the page. The usage method is as follows:

/*
 * @param {*} text
 */
The SafeUtils.escapeHtml(text) // method returns the escaped character string.

For example, enter the following character string:

<div data-v-a7e06658="" id="page-view-header" class="page-view-header" style="width: 1920px; height: 0px; overflow: hidden; display: none;"> <div data-v-a7e06658="" class="page-view-header-bottom" style="top: -11px;"></div></div>

The return value after XSS escape is as follows:

&lt;div data-v-a7e06658=&quot;&quot; id=&quot;page-view-header&quot; class=&quot;page-view-header&quot; style=&quot;width: 1920px; height: 0px; overflow: hidden; display: none;&quot;&gt; &lt;div data-v-a7e06658=&quot;&quot; class=&quot;page-view-header-bottom&quot; style=&quot;top: -11px;&quot;&gt;&lt;/div&gt;&lt;/div&gt;

getSafeUrl()

Perform XSS security filtering on external links to obtain secure absolute URLs. The usage is as follows: 
/*
 * @param {*} url
 */
SafeUtils.getSafeUrl(url);
SafeUtils.getSafeUrl ('/test.html') //return:https://Domain name of Huawei Cloud Astro Canvas /test.html
SafeUtils.getSafeUrl('javascript:alert(123)') //return:'unsafe:'

Only secure URLs can be accessed. URLs in other formats correspond to unsafe: and cannot be accessed.

Parent topic: Widget Built-in APIs