IBX-5054: HTML code gets removed from the Custom tag's string attribute #71
Conversation
|
Failing SOLR test is not related to changes in this PR... |
| const attributeValue = value !== null ? value : ''; | ||
| // Escaping | ||
| // <script>alert("Hello! I am a script!");</script> --> <script>alert("Hello! I am a script!");</script> | ||
| const stringTempNode = domDocument.createElement('div'); |
There was a problem hiding this comment.
What do you think about escaping without creating div?
const valueString = value ?? '';
const attributeValue = valueString
.replace(/&/g, "&")
.replace(/</g, "<")
.replace(/>/g, ">")
.replace(/"/g, """)
.replace(/'/g, "'");
There was a problem hiding this comment.
Escaping like I currently do seems to be quite common in JS. But if you prefer, I can change it as suggested. However, others have already approved it so not sure what others think of it.
I am not sure either if your suggestion covers all characters that needs to be escaped ?
There was a problem hiding this comment.
After talking with the frontend team, I approved for your solution :)
alongosz
force-pushed
the
ibx-5054-HTML_code_gets_removed_from_the_Custom_tag_string_attribute
branch
from
2165f6a
to
d51b59b
Compare
|
Rebased to see if we can get CI green. |
|
Kudos, SonarCloud Quality Gate passed!
|
alongosz
deleted the
ibx-5054-HTML_code_gets_removed_from_the_Custom_tag_string_attribute
branch
Missing escaping of input
TODO:
Implement tests.( Assume this is not needed for this one ?)$ composer fix-cs).