diff options
| author | eal <eal@waifu.club> | 2017-11-18 14:43:41 +0200 |
|---|---|---|
| committer | eal <eal@waifu.club> | 2017-11-18 14:43:41 +0200 |
| commit | 66e78c3ec4e524a31a4c12f4dbe682ccbbc0025d (patch) | |
| tree | f30c92d99205b311222c3a5a14e189e4f8d576f5 | |
| parent | 4647bcd6e647ad31ba492a6e712721b58bf47e83 (diff) | |
| download | pleroma-66e78c3ec4e524a31a4c12f4dbe682ccbbc0025d.tar.gz pleroma-66e78c3ec4e524a31a4c12f4dbe682ccbbc0025d.zip | |
Escape HTML instead of discarding it.
| -rw-r--r-- | lib/pleroma/web/common_api/utils.ex | 3 | ||||
| -rw-r--r-- | test/web/twitter_api/twitter_api_test.exs | 2 |
2 files changed, 3 insertions, 2 deletions
diff --git a/lib/pleroma/web/common_api/utils.ex b/lib/pleroma/web/common_api/utils.ex index 83a656011..21b6226b1 100644 --- a/lib/pleroma/web/common_api/utils.ex +++ b/lib/pleroma/web/common_api/utils.ex @@ -58,7 +58,8 @@ defmodule Pleroma.Web.CommonAPI.Utils do end def format_input(text, mentions, tags) do - HtmlSanitizeEx.strip_tags(text) + Phoenix.HTML.html_escape(text) + |> elem(1) |> Formatter.linkify |> String.replace("\n", "<br>\n") |> add_user_links(mentions) diff --git a/test/web/twitter_api/twitter_api_test.exs b/test/web/twitter_api/twitter_api_test.exs index 994cc8f90..8698686ad 100644 --- a/test/web/twitter_api/twitter_api_test.exs +++ b/test/web/twitter_api/twitter_api_test.exs @@ -34,7 +34,7 @@ defmodule Pleroma.Web.TwitterAPI.TwitterAPITest do { :ok, activity = %Activity{} } = TwitterAPI.create_status(user, input) - assert get_in(activity.data, ["object", "content"]) == "Hello again, <a href='shp'>@shp</a>.<br>\nThis is on another line. #2hu #epic #phantasmagoric<br>\n<a href=\"http://example.org/image.jpg\" class='attachment'>image.jpg</a>" + assert get_in(activity.data, ["object", "content"]) == "Hello again, <a href='shp'>@shp</a>.<script></script><br>\nThis is on another line. #2hu #epic #phantasmagoric<br>\n<a href=\"http://example.org/image.jpg\" class='attachment'>image.jpg</a>" assert get_in(activity.data, ["object", "type"]) == "Note" assert get_in(activity.data, ["object", "actor"]) == user.ap_id assert get_in(activity.data, ["actor"]) == user.ap_id |