diff --git a/src/components/Account/ActorCard.vue b/src/components/Account/ActorCard.vue index 2124b746..6856a2bd 100644 --- a/src/components/Account/ActorCard.vue +++ b/src/components/Account/ActorCard.vue @@ -30,7 +30,7 @@ @{{ usernameWithDomain(actor) }}

+
{ const formattedListOfParticipants = computed(() => { return formatList( otherParticipants.value.map( - (participant) => `${displayName(participant)}` + (participant) => `${escapeHtml(displayName(participant))}` ) ); }); diff --git a/src/plugins/notifier.ts b/src/plugins/notifier.ts index 0b5e9c3f..23719b70 100644 --- a/src/plugins/notifier.ts +++ b/src/plugins/notifier.ts @@ -1,3 +1,4 @@ +import { escapeHtml } from "@/utils/html"; import { App } from "vue"; export class Notifier { @@ -21,7 +22,7 @@ export class Notifier { private notification(message: string, type: string) { this.app.config.globalProperties.$oruga.notification.open({ - message, + message: escapeHtml(message), duration: 5000, position: "bottom-right", type, diff --git a/src/utils/html.ts b/src/utils/html.ts index 02b8763b..7f0ac34a 100644 --- a/src/utils/html.ts +++ b/src/utils/html.ts @@ -5,3 +5,13 @@ export const getValueFromMeta = (name: string): string | null => { } return null; }; + +export function escapeHtml(html: string) { + const p = document.createElement("p"); + p.appendChild(document.createTextNode(html.trim())); + + const escapedContent = p.innerHTML; + p.remove(); + + return escapedContent; +} diff --git a/src/views/Event/EditView.vue b/src/views/Event/EditView.vue index d833d8de..3d9deba6 100644 --- a/src/views/Event/EditView.vue +++ b/src/views/Event/EditView.vue @@ -180,7 +180,7 @@ { contact: formatList( event.contacts.map((contact) => - displayNameAndUsername(contact) + escapeHtml(displayNameAndUsername(contact)) ) ), }, @@ -628,6 +628,7 @@ import { useHead } from "@unhead/vue"; import { useProgrammatic } from "@oruga-ui/oruga-next"; import type { Locale } from "date-fns"; import sortBy from "lodash/sortBy"; +import { escapeHtml } from "@/utils/html"; const DEFAULT_LIMIT_NUMBER_OF_PLACES = 10;