mirror of
https://github.com/usememos/memos.git
synced 2025-06-05 22:09:59 +02:00
fix: code blocks of unknown languages cause HTML injection (#3711)
* fix: code blocks of unknown languages cause HTML injection A code block of unknown language (that is, a language not treated as special by Memos and not handled by highlight.js) should fall back on rendering its plaintext content. However, the content is never properly escaped before it is appended to the DOM, and thus any string that happens to contain HTML is unsafely rendered. This commit fixes the issue by ensuring that, when none of the previous cases handle the text, any HTML entities are escaped first. * Update CodeBlock.tsx to conform to eslint
This commit is contained in:
@@ -42,7 +42,10 @@ const CodeBlock: React.FC<Props> = ({ language, content }: Props) => {
|
||||
// Skip error and use default highlighted code.
|
||||
}
|
||||
|
||||
return content;
|
||||
// escape any HTML entities when rendering original content
|
||||
return Object.assign(document.createElement("span"), {
|
||||
textContent: content,
|
||||
}).innerHTML;
|
||||
}, [formatedLanguage, content]);
|
||||
|
||||
const handleCopyButtonClick = useCallback(() => {
|
||||
|
Reference in New Issue
Block a user