search

NetrunnerDB / netrunnerdb

A Deckbuilder for Android:Netrunner LCG
https://netrunnerdb.com
MIT License
142 stars 77 forks source link

Sanitize instead of escape #868

Open xdg opened 1 day ago

xdg commented 1 day ago

PR #846 escaped special HTML characters in raw user-provided text, such as deck notes, with the unintentional side effect that these entities were encoded on save, and then re-encoded on the next save, etc. leaving deck notes, etc. effectively un-editable from a practical perspective.

This PR reverts #846 and replaces it with HTML sanitization using DOM Purify when raw user-provided text is rendered via Javascript.

Fixes #864.

plural commented 2 hours ago

Thanks! One other thing is that the preview does not appear to be working with this PR. While typing deck notes, the preview box stays static:

Screenshot 2024-11-23 at 9 05 17 AM
xdg commented 2 hours ago

The preview box not updating until keypress is like that on the deployed nrdb already.

plural commented 1 hour ago

Locally with your or parched in deck notes preview is not updating even when changing the contents.

I’m not at my computer at the moment to look more closely though.

On Sat, Nov 23, 2024 at 9:40 AM David Golden @.***> wrote:

The preview box not updating until keypress is like that on the deployed nrdb already.

https://camo.githubusercontent.com/425a3c57fdd83e4433e3a5d34c9444bf020e128439927cad4aeff0c937322e98/68747470733a2f2f7777772e64726f70626f782e636f6d2f73636c2f66692f7176623766653765336d7338617078387a636b71372f323032342d31312d32335f30392d33382e706e673f726c6b65793d726a65653875676b396675677535787576383534796a62326a26646c3d30267261773d31

— Reply to this email directly, view it on GitHub https://github.com/NetrunnerDB/netrunnerdb/pull/868#issuecomment-2495500647, or unsubscribe https://github.com/notifications/unsubscribe-auth/AADA2EXU5ZKXCAOWKKPL3O32CCHXNAVCNFSM6AAAAABSIIV7MGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDIOJVGUYDANRUG4 . You are receiving this because you commented.Message ID: @.***>