Trusted Markup

Render data-supplied HTML and SVG in panels only through the panel core SafeMarkup boundary. Select html or svg mode explicitly for SVG. Do not assign raw markup to innerHTML, use dangerouslySetInnerHTML, or insert adjacent HTML in part panels, panel core, or runnable panels.

Correct

import { SafeMarkup } from 'panel'; export default ({ value }) => <SafeMarkup html={value} mode='svg' />

Incorrect

export default ({ value }) => <span dangerouslySetInnerHTML={{ __html: value }} />
element.innerHTML = value

Fix

Replace the raw markup sink with SafeMarkup from panel core. For imperative panel core rendering, sanitize immediately before the DOM write through the same sanitizer.