diff options
| author | feld <feld@feld.me> | 2020-02-06 16:12:11 +0000 |
|---|---|---|
| committer | feld <feld@feld.me> | 2020-02-06 16:12:11 +0000 |
| commit | 8fcb9c42aad9e623287c26244f079fc5028c6359 (patch) | |
| tree | e7ef10e9b4f9c528206ca9e7c4431f2307f004d6 | |
| parent | e73e235b4df4654abbfd315645ed7ad35e0f326e (diff) | |
| parent | 746416207bd15f7883af18e359b84f0c4444a12a (diff) | |
Merge branch 'fix/escape-html' into 'develop'
Escape HTML from display name and subject fields
Closes #724
See merge request pleroma/pleroma-fe!1052
| -rw-r--r-- | package.json | 1 | ||||
| -rw-r--r-- | src/services/entity_normalizer/entity_normalizer.service.js | 6 | ||||
| -rw-r--r-- | yarn.lock | 3 |
3 files changed, 7 insertions, 3 deletions
diff --git a/package.json b/package.json index 9ec8c1eb..5c7fa31e 100644 --- a/package.json +++ b/package.json @@ -21,6 +21,7 @@ "chromatism": "^3.0.0", "cropperjs": "^1.4.3", "diff": "^3.0.1", + "escape-html": "^1.0.3", "karma-mocha-reporter": "^2.2.1", "localforage": "^1.5.0", "object-path": "^0.11.3", diff --git a/src/services/entity_normalizer/entity_normalizer.service.js b/src/services/entity_normalizer/entity_normalizer.service.js index a3d0b782..3116d211 100644 --- a/src/services/entity_normalizer/entity_normalizer.service.js +++ b/src/services/entity_normalizer/entity_normalizer.service.js @@ -1,3 +1,5 @@ +import escape from 'escape-html' + const qvitterStatusType = (status) => { if (status.is_post_verb) { return 'status' @@ -41,7 +43,7 @@ export const parseUser = (data) => { } output.name = data.display_name - output.name_html = addEmojis(data.display_name, data.emojis) + output.name_html = addEmojis(escape(data.display_name), data.emojis) output.description = data.note output.description_html = addEmojis(data.note, data.emojis) @@ -256,7 +258,7 @@ export const parseStatus = (data) => { output.retweeted_status = parseStatus(data.reblog) } - output.summary_html = addEmojis(data.spoiler_text, data.emojis) + output.summary_html = addEmojis(escape(data.spoiler_text), data.emojis) output.external_url = data.url output.poll = data.poll output.pinned = data.pinned @@ -2757,9 +2757,10 @@ es6-promisify@^5.0.0: dependencies: es6-promise "^4.0.3" -escape-html@~1.0.3: +escape-html@^1.0.3, escape-html@~1.0.3: version "1.0.3" resolved "https://registry.yarnpkg.com/escape-html/-/escape-html-1.0.3.tgz#0258eae4d3d0c0974de1c169188ef0051d1d1988" + integrity sha1-Aljq5NPQwJdN4cFpGI7wBR0dGYg= escape-string-regexp@1.0.5, escape-string-regexp@^1.0.2, escape-string-regexp@^1.0.5: version "1.0.5" |