diff --git a/browser/components/MarkdownPreview.js b/browser/components/MarkdownPreview.js index 4d2633190..c38415aaf 100755 --- a/browser/components/MarkdownPreview.js +++ b/browser/components/MarkdownPreview.js @@ -85,6 +85,14 @@ function getSourceLineNumberByElement(element) { return parent.dataset.line !== undefined ? parseInt(parent.dataset.line) : -1 } +function escapeRegExp(string) { + return string.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&') // $& means the whole matched string +} + +function replaceAll(str, find, replace) { + return str.replace(new RegExp(escapeRegExp(find), 'g'), replace) +} + class MarkdownPreview extends React.Component { constructor(props) { super(props) @@ -496,7 +504,13 @@ class MarkdownPreview extends React.Component { let syntax = CodeMirror.findModeByName(convertModeName(el.className)) if (syntax == null) syntax = CodeMirror.findModeByName('Plain Text') CodeMirror.requireMode(syntax.mode, () => { - const content = htmlTextHelper.decodeEntities(el.innerHTML) + let content = el.innerHTML + content = replaceAll(content, ''', "'") + content = replaceAll(content, '<', '<') + content = replaceAll(content, '>', '>') + content = replaceAll(content, '?', '?') + content = replaceAll(content, '$', '$') + content = replaceAll(content, '&', '&') const copyIcon = document.createElement('i') copyIcon.innerHTML = '' diff --git a/browser/lib/markdown-it-sanitize-html.js b/browser/lib/markdown-it-sanitize-html.js index b93e866ff..a9024b141 100644 --- a/browser/lib/markdown-it-sanitize-html.js +++ b/browser/lib/markdown-it-sanitize-html.js @@ -1,7 +1,6 @@ 'use strict' import sanitizeHtml from 'sanitize-html' -import { escapeHtmlCharacters } from './utils' import url from 'url' module.exports = function sanitizePlugin(md, options) { @@ -17,9 +16,11 @@ module.exports = function sanitizePlugin(md, options) { } if (state.tokens[tokenIdx].type.match(/.*_fence$/)) { // escapeHtmlCharacters has better performance - state.tokens[tokenIdx].content = escapeHtmlCharacters( - state.tokens[tokenIdx].content, - { skipSingleQuote: true } + state.tokens[tokenIdx].content = state.tokens[tokenIdx].content.replace( + /[\u00A0-\u9999<>\&]/gim, + function(i) { + return '&#' + i.charCodeAt(0) + ';' + } ) } if (state.tokens[tokenIdx].type === 'inline') {