Fix most ecaping of user provided input

LycheeOrg / Lychee-front

JS implementation of Lychee frontend

https://lycheeorg.github.io/

MIT License

48 stars 53 forks source link

Fix most ecaping of user provided input #325

Closed nagmat84 closed 2 years ago

nagmat84 commented 2 years ago

This PR add lychee.html and the double-dollar operator in front of user-supplied data.

I did a quick search for the regex [^$]\$\{[^}]*(title|Title|name|desc) and hopefully I found all problematic cases. This is a hotfix. In particular it might introduce some undesired regression due to "double" escaping. But it should mostly be fine.

nagmat84 commented 2 years ago

I converted this to a draft, because after playing around with this PR some while, I encountered the "double-escape" problem. :-(

screenshot-2022-09-24 _17-38-15