paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-11-04 14:03:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

copy_and_paste: Fix HTML injection bug in construct_copy_div.

Browse Source 
Signed-off-by: Anders Kaseorg <anders@zulip.com>
This commit is contained in:
Anders Kaseorg
2024-04-02 17:50:19 -07:00
committed by Tim Abbott
parent 25ff0d4418
commit e1029b59ed
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
web/src/copy_and_paste.js
View File

@@ -90,7 +90,11 @@ function construct_copy_div($div, start_id, end_id) {
} }
const message = message_lists.current.get(rows.id($row)); const message = message_lists.current.get(rows.id($row));
const $content = $(message.content); const $content = $(message.content);
$content.first().prepend(message.sender_full_name + ": "); $content.first().prepend(
$("<span>")
.text(message.sender_full_name + ": ")
.contents(),
);
$div.append($content); $div.append($content);
} }