Marmelator/red-ui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1.4k Wiki Activity

RED-9889: escape html in component values.

Browse Source
This commit is contained in:
Nicoleta Panaghiu 2024-08-20 15:11:30 +03:00
parent 021775d3a7
commit 6a6db17d2c
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
apps/red-ui/src/app/modules/file-preview/components/editable-structured-component-value/editable-structured-component-value.component.html
View File

@ -4,7 +4,7 @@
<div class="value">
<div class="text">
@for (componentValue of entry.componentValues; track componentValue) {
<span [innerHTML]="transformNewLines(componentValue.value ?? componentValue.originalValue)"></span>
<span [innerHTML]="transformNewLines(componentValue.value ?? componentValue.originalValue) | replaceNbsp"></span>
}
</div>
<div class="actions">

5
apps/red-ui/src/app/modules/file-preview/components/editable-structured-component-value/editable-structured-component-value.component.ts
View File

@ -8,6 +8,8 @@ import { TranslateModule } from '@ngx-translate/core';
import { IComponentLogEntry, IComponentValue } from '@red/domain';
import { RevertValueDialogComponent } from '../../dialogs/docu-mine/revert-value-dialog/revert-value-dialog.component';
import { FilePreviewStateService } from '../../services/file-preview-state.service';
import { escapeHtml } from '@common-ui/utils';
import { ReplaceNbspPipe } from '@common-ui/pipes/replace-nbsp.pipe';
@Component({
selector: 'redaction-editable-structured-component-value [entry] [canEdit]',
@ -28,6 +30,7 @@ import { FilePreviewStateService } from '../../services/file-preview-state.servi
CdkDragHandle,
FormsModule,
AsyncPipe,
ReplaceNbspPipe,
],
})
export class EditableStructuredComponentValueComponent implements OnInit {
@ -149,7 +152,7 @@ export class EditableStructuredComponentValueComponent implements OnInit {
}
transformNewLines(value: string) {
return value.replace(/\n/g, '<br>');
return escapeHtml(value).replace(/\n/g, '<br>');
}
#getUniqueReferencesIds(values: IComponentValue[]) {