[IM] Prevent XSS / JS interpretation in preview boxes [ref: 555-9-9]

inex · Oct 21, 2022 · 083d17e · 083d17e
1 parent 2889be9
commit 083d17e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/Http/Controllers/Api/V4/UtilsController.php b/app/Http/Controllers/Api/V4/UtilsController.php
@@ -54,7 +54,7 @@ public function markdown( Request $r ): JsonResponse
     {
         $pd = new Parsedown();
         return response()->json([
-            'html' => $pd->text( $r->text )
+            'html' => htmlspecialchars( $pd->text( $r->text ) )
         ]);
     }
 }