PowerBI Custom Viz Certification : Usage of innerHTML

[AnatolePIVETEAU]

Hello everyone,

I'm in the process of developing a visualization containing a certain intelligence to generate comments.

I wanted to ask the community the following question:

- Is the use of innerHTML just forbidden or is it only in certain cases (use on source data or on user input) for PowerBI Custom Viz Certification ?

In my case, I use .innerHTML to translate text while maintaining pre-defined formatting. Things to which the user has no access (he can't evaluate HTML code, as these will be escaped).

Is this use a blocking factor for PowerBI Custom Viz certification?

Many thanks to the community, and I hope to be able to help in the near future.

Best regards, 
Anatole PIVETEAU
Developer at Datama [datama.io]

[dm-p]

Hi @AnatolePIVETEAU,

It's completely forbidden. The linting checks run as part of the certification process will detect its use and report it as an issue that needs to be resolved. You'll then need to fix this and resubmit a valid approach for the visual to pass certification.

If you want to add specific HTML to the DOM, you'll need to guarantee that you're adding a valid Node rather than text-based content. Even if it doesn't contain user input, your code may try to do something technically invalid that causes rendering issues - even if you are well-intentioned - and this won't get caught until execution time.

I've personally handled it in one of my visuals (which does allow arbitrary content) by using a package like sanitize-html, running my desired output through this to get a valid Node as output, and using a suitable manipulation method on the desired anchor node. This visual is certified and is regularly updated, so this approach will still work under the certification rules. Another company I work with writes their own in-house sanitization library and this also passes certification (but it essentially does the same thing as sanitize-html).

If you want to have a look at how I'm doing it, my certified visual - HTML Content (lite) - is open source and you're welcome to crib anything you learn from that. The specific part of the visual that handles it begins here.

Good luck with certification!

Daniel