PrivateCoffee/element-web
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 3

ooops, don't forget to actually sanitize the highlights after all that

Browse source
This commit is contained in:
Matthew Hodgson 2016-02-10 23:45:07 +00:00
parent d055dbe522
commit 92435c0865
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/HtmlUtils.js
View file

@ -144,15 +144,17 @@ module.exports = {
// by an attempt to search for 'foobar'. Then again, the search query probably wouldn't work either
if (highlights && highlights.length > 0) {
var highlighter = new Highlighter(isHtml, "mx_EventTile_searchHighlight", opts.onHighlightClick);
var safeHighlights = highlights.map(function(highlight) {
return sanitizeHtml(highlight, sanitizeHtmlParams);
});
// XXX: hacky bodge to temporarily apply a textFilter to the sanitizeHtmlParams structure.
sanitizeHtmlParams.textFilter = function(safeText) {
var html = highlighter.applyHighlights(safeText, highlights).map(function(span) {
return highlighter.applyHighlights(safeText, safeHighlights).map(function(span) {
// XXX: rather clunky conversion from the react nodes returned by applyHighlights
// (which need to be nodes for the non-html highlighting case), to convert them
// back into raw HTML given that's what sanitize-html works in terms of.
return ReactDOMServer.renderToString(span);
}).join('');
return html;
};
}
safeBody = sanitizeHtml(content.formatted_body, sanitizeHtmlParams);