strk/friendica
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Escape major HTML characters in code blocks in BBCode::convert

Browse source 
- HTML sanitization was removing unescaped opening chevrons in code blocks
This commit is contained in:
Hypolite Petovan 2019-12-27 21:40:41 -05:00
parent 39cb3e68b9
commit aa3a85c727
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/Content/Text/BBCode.php
View file

@ -1283,9 +1283,9 @@ class BBCode extends BaseObject
function ($matches) use (&$codeblocks) {
$return = '#codeblock-' . count($codeblocks) . '#';
if (strpos($matches[2], "\n") !== false) {
$codeblocks[] = '<pre><code class="language-' . trim($matches[1]) . '">' . trim($matches[2], "\n\r") . '</code></pre>';
$codeblocks[] = '<pre><code class="language-' . trim($matches[1]) . '">' . htmlspecialchars(trim($matches[2], "\n\r"), ENT_NOQUOTES, 'UTF-8') . '</code></pre>';
} else {
$codeblocks[] = '<code>' . $matches[2] . '</code>';
$codeblocks[] = '<code>' . htmlspecialchars($matches[2], ENT_NOQUOTES, 'UTF-8') . '</code>';
}
return $return;