diff options
| author | Henry Jameson <me@hjkos.com> | 2020-02-11 10:03:34 +0200 |
|---|---|---|
| committer | Henry Jameson <me@hjkos.com> | 2020-02-11 10:03:34 +0200 |
| commit | 786a695eb6c4399bbbf3fe569cae0623c17b4618 (patch) | |
| tree | 6266845710c0e632cb941ac8bc296778b73ce4f4 /src/services/entity_normalizer/entity_normalizer.service.js | |
| parent | 6f3ac707f76b302e993eeb3eaeb415bc3d68502b (diff) | |
| parent | 8fcb9c42aad9e623287c26244f079fc5028c6359 (diff) | |
Merge remote-tracking branch 'upstream/develop' into themes-accent
* upstream/develop:
Fix one click nsfw unhide on videos
Escape HTML from display name and subject fields
Diffstat (limited to 'src/services/entity_normalizer/entity_normalizer.service.js')
| -rw-r--r-- | src/services/entity_normalizer/entity_normalizer.service.js | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/src/services/entity_normalizer/entity_normalizer.service.js b/src/services/entity_normalizer/entity_normalizer.service.js index a3d0b782..3116d211 100644 --- a/src/services/entity_normalizer/entity_normalizer.service.js +++ b/src/services/entity_normalizer/entity_normalizer.service.js @@ -1,3 +1,5 @@ +import escape from 'escape-html' + const qvitterStatusType = (status) => { if (status.is_post_verb) { return 'status' @@ -41,7 +43,7 @@ export const parseUser = (data) => { } output.name = data.display_name - output.name_html = addEmojis(data.display_name, data.emojis) + output.name_html = addEmojis(escape(data.display_name), data.emojis) output.description = data.note output.description_html = addEmojis(data.note, data.emojis) @@ -256,7 +258,7 @@ export const parseStatus = (data) => { output.retweeted_status = parseStatus(data.reblog) } - output.summary_html = addEmojis(data.spoiler_text, data.emojis) + output.summary_html = addEmojis(escape(data.spoiler_text), data.emojis) output.external_url = data.url output.poll = data.poll output.pinned = data.pinned |