fix: sanitize html string (#784)

standardnotes · Dec 24, 2021 · 7f011d7 · 7f011d7
1 parent ebdae31
commit 7f011d7
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 717 deletions.
diff --git a/app/assets/javascripts/app.ts b/app/assets/javascripts/app.ts
@@ -124,7 +124,7 @@ const startApplication: StartApplication = async function startApplication(
   SNLog.onLog = console.log;
   startErrorReporting();
 
-  angular.module('app', ['ngSanitize']);
+  angular.module('app', []);
 
   // Config
   angular

diff --git a/app/assets/javascripts/components/NotesListItem.tsx b/app/assets/javascripts/components/NotesListItem.tsx
@@ -1,4 +1,8 @@
-import { CollectionSort, SNNote } from '@standardnotes/snjs';
+import {
+  CollectionSort,
+  sanitizeHtmlString,
+  SNNote,
+} from '@standardnotes/snjs';
 import { FunctionComponent } from 'preact';
 
 type Props = {
@@ -108,7 +112,9 @@ export const NotesListItem: FunctionComponent<Props> = ({
           {note.preview_html ? (
             <div
               className="html-preview"
-              dangerouslySetInnerHTML={{ __html: note.preview_html }}
+              dangerouslySetInnerHTML={{
+                __html: sanitizeHtmlString(note.preview_html),
+              }}
             ></div>
           ) : null}
           {!note.preview_html && note.preview_plain ? (

diff --git a/app/assets/javascripts/index.ts b/app/assets/javascripts/index.ts
@@ -6,7 +6,6 @@ import '../stylesheets/index.css.scss';
 
 // Vendor
 import 'angular';
-import '../../../vendor/assets/javascripts/angular-sanitize';
 import '../../../vendor/assets/javascripts/zip/deflate';
 import '../../../vendor/assets/javascripts/zip/inflate';
 import '../../../vendor/assets/javascripts/zip/zip';