mirror of
https://git.tt-rss.org/fox/tt-rss.git
synced 2025-10-18 14:31:00 +02:00
Fix a potential double-unescaping issue, tweak 'App.escapeHtml()'.
This commit is contained in:
parent
26f1f67746
commit
b888fa1032
24
js/App.js
24
js/App.js
@ -411,19 +411,35 @@ const App = {
|
|||||||
},
|
},
|
||||||
// htmlspecialchars()-alike for headlines data-content attribute
|
// htmlspecialchars()-alike for headlines data-content attribute
|
||||||
escapeHtml: function(p) {
|
escapeHtml: function(p) {
|
||||||
if (typeof p == "string") {
|
if (typeof p !== 'string')
|
||||||
|
return p;
|
||||||
|
|
||||||
const map = {
|
const map = {
|
||||||
'&': '&',
|
'&': '&',
|
||||||
'<': '<',
|
'<': '<',
|
||||||
'>': '>',
|
'>': '>',
|
||||||
'"': '"',
|
'"': '"',
|
||||||
"'": '''
|
"'": ''',
|
||||||
|
'/': '/',
|
||||||
};
|
};
|
||||||
|
|
||||||
return p.replace(/[&<>"']/g, function(m) { return map[m]; });
|
return p.replace(/[&<>"'\/]/g, m => map[m]);
|
||||||
} else {
|
},
|
||||||
|
unescapeHtml: function(p) {
|
||||||
|
if (typeof p !== 'string' || p.indexOf('&') === -1)
|
||||||
return p;
|
return p;
|
||||||
|
|
||||||
|
return p.replace(/&(?:amp|lt|gt|quot|#x27|#x2F|#039|#47);/g, function(entity) {
|
||||||
|
switch (entity) {
|
||||||
|
case '&': return '&';
|
||||||
|
case '<': return '<';
|
||||||
|
case '>': return '>';
|
||||||
|
case '"': return '"';
|
||||||
|
case ''': case ''': return "'";
|
||||||
|
case '/': case '/': return '/';
|
||||||
|
default: return entity;
|
||||||
}
|
}
|
||||||
|
});
|
||||||
},
|
},
|
||||||
// http://stackoverflow.com/questions/6251937/how-to-get-selecteduser-highlighted-text-in-contenteditable-element-and-replac
|
// http://stackoverflow.com/questions/6251937/how-to-get-selecteduser-highlighted-text-in-contenteditable-element-and-replac
|
||||||
getSelectedText: function() {
|
getSelectedText: function() {
|
||||||
|
@ -237,16 +237,7 @@ define(["dojo/_base/declare", "dojo/dom-construct", "dojo/_base/array", "dojo/co
|
|||||||
return rc;
|
return rc;
|
||||||
},
|
},
|
||||||
getLabel: function(item) {
|
getLabel: function(item) {
|
||||||
let name = String(item.name);
|
return App.unescapeHtml(item.name);
|
||||||
|
|
||||||
/* Horrible */
|
|
||||||
name = name.replace(/"/g, "\"");
|
|
||||||
name = name.replace(/&/g, "&");
|
|
||||||
name = name.replace(/—/g, "-");
|
|
||||||
name = name.replace(/</g, "<");
|
|
||||||
name = name.replace(/>/g, ">");
|
|
||||||
|
|
||||||
return name;
|
|
||||||
},
|
},
|
||||||
expandParentNodes: function(feed, is_cat, list) {
|
expandParentNodes: function(feed, is_cat, list) {
|
||||||
try {
|
try {
|
||||||
|
Loading…
x
Reference in New Issue
Block a user