Escape HTML tags in comments

devilry / devilry-django

Devilry project main repository

http://devilry.org

BSD 3-Clause "New" or "Revised" License

51 stars 24 forks source link

Escape HTML tags in comments #1275

Closed torgeirl closed 11 months ago

torgeirl commented 12 months ago

After the introduction of the updated comment editor in Devilry 5.5 we have had a few examples of certain HTML tags in comments causing client-side rendering issues.

Suggested solution a) Either strip away HTML tags in comment texts if they are missing surrounding single grave accents (ie. `<table>`) , or b) auto-encapsule them with single grave accents if they are missing

Levijatan commented 11 months ago

Created a milestone-6.2 branch and pushed up a fix for this. Ended up with using html-sanitizer to remove all not allowed tags, luckely it escapes tags inside code blocks instead of removing them so it was quite easy to sanitize after the markdown to html conversion step.

torgeirl commented 11 months ago

Added in 0363c95e3469a5267ae39687be761ca9a7c3c075.