fix: sanitize html string (#784)

2021-12-24 10:45:55 -06:00
parent ebdae31965
commit 7f011d7288
4 changed files with 9 additions and 717 deletions
--- a/app/assets/javascripts/components/NotesListItem.tsx
+++ b/app/assets/javascripts/components/NotesListItem.tsx
@@ -1,4 +1,8 @@
-import { CollectionSort, SNNote } from '@standardnotes/snjs';
+import {
+  CollectionSort,
+  sanitizeHtmlString,
+  SNNote,
+} from '@standardnotes/snjs';
 import { FunctionComponent } from 'preact';

 type Props = {
@@ -108,7 +112,9 @@ export const NotesListItem: FunctionComponent<Props> = ({
          {note.preview_html ? (
            <div
              className="html-preview"
-              dangerouslySetInnerHTML={{ __html: note.preview_html }}
+              dangerouslySetInnerHTML={{
+                __html: sanitizeHtmlString(note.preview_html),
+              }}
            ></div>
          ) : null}
          {!note.preview_html && note.preview_plain ? (