almet/umap
1
0
Fork 0
mirror of https://github.com/umap-project/umap.git synced 2025-04-29 11:52:38 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fixup: escape Wikipedia HTML, just in case

Browse source
This commit is contained in:
Yohan Boniface 2024-12-17 18:49:49 +01:00
parent 6e5540fe79
commit 92df1d792a
2 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
umap/static/umap/js/modules/rendering/template.js
View file

@ -271,7 +271,7 @@ class Wikipedia extends PopupTemplate {
const extract = page.extract || '' const extract = page.extract || ''
const thumbnail = page.thumbnail?.source const thumbnail = page.thumbnail?.source
const [content, { image }] = Utils.loadTemplateWithRefs( const [content, { image }] = Utils.loadTemplateWithRefs(
`<div><h3>${title}</h3><img data-ref="image" hidden src="" />${extract}</div>` `<div><h3>${Utils.escapeHTML(title)}</h3><img data-ref="image" hidden src="" />${Utils.escapeHTML(extract)}</div>`
) )
if (thumbnail) { if (thumbnail) {
image.src = thumbnail image.src = thumbnail

2
umap/static/umap/js/modules/utils.js
View file

@ -115,6 +115,8 @@ export function escapeHTML(s) {
'span', 'span',
'dt', 'dt',
'dd', 'dd',
'b',
'i',
], ],
ADD_ATTR: [ ADD_ATTR: [
'target', 'target',