From 87ca739a3f70b4e7e298f65630533499fc101259 Mon Sep 17 00:00:00 2001 From: zeripath Date: Wed, 17 Aug 2022 20:43:53 +0100 Subject: [PATCH] Correctly escape within tribute.js (#20831) When writing html in tribute.js ensure that strings are properly escaped. Signed-off-by: Andrew Thornton Signed-off-by: Andrew Thornton --- web_src/js/features/tribute.js | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/web_src/js/features/tribute.js b/web_src/js/features/tribute.js index 053804c43..5678acdf4 100644 --- a/web_src/js/features/tribute.js +++ b/web_src/js/features/tribute.js @@ -1,5 +1,6 @@ import {emojiKeys, emojiHTML, emojiString} from './emoji.js'; import {uniq} from '../utils.js'; +import {htmlEscape} from 'escape-goat'; function makeCollections({mentions, emoji}) { const collections = []; @@ -24,7 +25,7 @@ function makeCollections({mentions, emoji}) { return emojiString(item.original); }, menuItemTemplate: (item) => { - return `
${emojiHTML(item.original)}${item.original}
`; + return `
${emojiHTML(item.original)}${htmlEscape(item.original)}
`; } }); } @@ -36,9 +37,9 @@ function makeCollections({mentions, emoji}) { menuItemTemplate: (item) => { return `
- - ${item.original.name} - ${item.original.fullname && item.original.fullname !== '' ? `${item.original.fullname}` : ''} + + ${htmlEscape(item.original.name)} + ${item.original.fullname && item.original.fullname !== '' ? `${htmlEscape(item.original.fullname)}` : ''}
`; }