diff options
Diffstat (limited to 'webapp/utils')
| -rw-r--r-- | webapp/utils/text_formatting.jsx | 19 | ||||
| -rw-r--r-- | webapp/utils/utils.jsx | 4 |
2 files changed, 16 insertions, 7 deletions
diff --git a/webapp/utils/text_formatting.jsx b/webapp/utils/text_formatting.jsx index 4602a31b2..e34b8fdbb 100644 --- a/webapp/utils/text_formatting.jsx +++ b/webapp/utils/text_formatting.jsx @@ -185,7 +185,7 @@ function autolinkChannelMentions(text, tokens, channelNamesMap, team) { } tokens.set(alias, { - value: `<a class='mention-link' href="${href}" data-channel-mention="${channelName}">${displayName}</a>`, + value: `<a class="mention-link" href="${href}" data-channel-mention="${channelName}">~${displayName}</a>`, originalText: mention }); return alias; @@ -196,7 +196,7 @@ function autolinkChannelMentions(text, tokens, channelNamesMap, team) { if (channelMentionExists(channelNameLower)) { // Exact match - const alias = addToken(channelNameLower, mention, '~' + channelNamesMap[channelNameLower].display_name); + const alias = addToken(channelNameLower, mention, escapeHtml(channelNamesMap[channelNameLower].display_name)); return spacer + alias; } @@ -209,7 +209,8 @@ function autolinkChannelMentions(text, tokens, channelNamesMap, team) { if (channelMentionExists(channelNameLower)) { const suffix = originalChannelName.substr(c - 1); - const alias = addToken(channelNameLower, '~' + channelNameLower, '~' + channelNamesMap[channelNameLower].display_name); + const alias = addToken(channelNameLower, '~' + channelNameLower, + escapeHtml(channelNamesMap[channelNameLower].display_name)); return spacer + alias + suffix; } } else { @@ -231,6 +232,18 @@ export function escapeRegex(text) { return text.replace(/[-/\\^$*+?.()|[\]{}]/g, '\\$&'); } +const htmlEntities = { + '&': '&', + '<': '<', + '>': '>', + '"': '"', + "'": ''' +}; + +export function escapeHtml(text) { + return text.replace(/[&<>"']/g, (match) => htmlEntities[match]); +} + function highlightCurrentMentions(text, tokens, mentionKeys = []) { let output = text; diff --git a/webapp/utils/utils.jsx b/webapp/utils/utils.jsx index b99f7b967..aa98a9872 100644 --- a/webapp/utils/utils.jsx +++ b/webapp/utils/utils.jsx @@ -242,10 +242,6 @@ export function extractFirstLink(text) { return ''; } -export function escapeRegExp(string) { - return string.replace(/([.*+?^=!:${}()|[\]/\\])/g, '\\$1'); -} - // Taken from http://stackoverflow.com/questions/1068834/object-comparison-in-javascript and modified slightly export function areObjectsEqual(x, y) { let p; |