skorotkiewicz/yosup
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

web: fix sanitization

Browse source
This commit is contained in:
Thomas Mathews 2022-12-20 10:25:15 -08:00
parent 7a3a4077e8
commit 21604bd859
3 changed files with 20 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

12
web/js/ui/fmt.js
View file

@ -31,7 +31,7 @@ function format_content(ev, show_media) {
return "❤️" return "❤️"
return sanitize(ev.content.trim()); return sanitize(ev.content.trim());
} }
const content = sanitize(ev.content.trim()); const content = ev.content.trim();
const body = convert_quote_blocks(content, show_media) const body = convert_quote_blocks(content, show_media)
let cw = get_content_warning(ev.tags) let cw = get_content_warning(ev.tags)
if (cw !== null) { if (cw !== null) {
@ -39,9 +39,9 @@ function format_content(ev, show_media) {
if (cw === "") { if (cw === "") {
cwHTML += "." cwHTML += "."
} else { } else {
cwHTML += `: "<span>${cw}</span>".` cwHTML += html`: "<span>${cw}</span>".`
} }
return ` return html`
<details class="cw"> <details class="cw">
<summary class="event-message">${cwHTML}</summary> <summary class="event-message">${cwHTML}</summary>
${body} ${body}
@ -78,16 +78,12 @@ function convert_quote_blocks(content, show_media)
* the profile. * the profile.
*/ */
function fmt_profile_name(profile={}, fallback="Anonymous") { function fmt_profile_name(profile={}, fallback="Anonymous") {
if (profile.sanitized_name)
return profile.sanitized_name
const name = profile.display_name || profile.user || profile.name || const name = profile.display_name || profile.user || profile.name ||
fallback fallback
profile.sanitized_name = sanitize(name) return html`${name}`;
return profile.sanitized_name
} }
function fmt_pubkey(pk) { function fmt_pubkey(pk) {
return pk.slice(-8) return pk.slice(-8)
} }

22
web/js/ui/render.js
View file

@ -73,7 +73,7 @@ function render_replying_to(model, ev) {
const names = pubkeys.map((pk) => { const names = pubkeys.map((pk) => {
return render_mentioned_name(pk, model.profiles[pk]); return render_mentioned_name(pk, model.profiles[pk]);
}).join(", ") }).join(", ")
return html` return `
<span class="replying-to small-txt"> <span class="replying-to small-txt">
replying to ${names} replying to ${names}
</span> </span>
@ -100,23 +100,23 @@ function render_comment_body(model, ev, opts) {
// Only show media for content that is by friends. // Only show media for content that is by friends.
const show_media = !opts.is_composing && const show_media = !opts.is_composing &&
model.contacts.friends.has(ev.pubkey); model.contacts.friends.has(ev.pubkey);
return html` return `
<div> <div>
$${render_replying_to(model, ev)} ${render_replying_to(model, ev)}
$${render_shared_by(ev, opts)} ${render_shared_by(ev, opts)}
</div> </div>
<p> <p>
$${format_content(ev, show_media)} ${format_content(ev, show_media)}
</p> </p>
$${render_reactions(model, ev)} ${render_reactions(model, ev)}
$${bar}` ${bar}`
} }
function render_shared_by(ev, opts) { function render_shared_by(ev, opts) {
if (!opts.shared) if (!opts.shared)
return ""; return "";
const { profile, pubkey } = opts.shared const { profile, pubkey } = opts.shared
return html`<div class="shared-by">Shared by $${render_name(pubkey, profile)} return `<div class="shared-by">Shared by ${render_name(pubkey, profile)}
</div>` </div>`
} }
@ -254,7 +254,7 @@ function render_reactions_inner(model, ev) {
} }
function render_reactions(model, ev) { function render_reactions(model, ev) {
return html`<div class="reactions">${render_reactions_inner(model, ev)}</div>` return html`<div class="reactions">$${render_reactions_inner(model, ev)}</div>`
} }
// Utility Methods // Utility Methods
@ -281,11 +281,11 @@ function render_name(pk, profile, prefix="") {
function render_pfp(pk, profile, opts={}) { function render_pfp(pk, profile, opts={}) {
const name = fmt_profile_name(profile, fmt_pubkey(pk)); const name = fmt_profile_name(profile, fmt_pubkey(pk));
let str = `class="pfp clickable" onclick="open_profile('${pk}')"`; let str = html`class="pfp clickable" onclick="open_profile('${pk}')"`;
if (opts.noclick) if (opts.noclick)
str = "class='pfp'"; str = "class='pfp'";
return html`<img return html`<img
${str} $${str}
data-pubkey="${pk}" data-pubkey="${pk}"
title="${name}" title="${name}"
onerror="this.onerror=null;this.src='${robohash(pk)}';" onerror="this.onerror=null;this.src='${robohash(pk)}';"

8
web/js/ui/state.js
View file

@ -109,14 +109,16 @@ function view_timeline_update(model) {
// find prior event element and insert it before that // find prior event element and insert it before that
let prior_el; let prior_el;
let prior_idx = arr_bsearch_insert(all, ev, event_cmp_created); let prior_idx = arr_bsearch_insert(all, ev, event_cmp_created);
while (prior_idx > 0 && !prior_el) { while (prior_idx >= 0 && !prior_el) {
prior_el = find_node("#ev"+all[prior_idx].id, el); prior_el = find_node("#ev"+all[prior_idx].id, el);
prior_idx--; prior_idx--;
} }
if (!prior_el) { if (prior_el) {
el.insertBefore(ev_el, prior_el);
} else if (el.childElementCount == 0) {
el.appendChild(ev_el); el.appendChild(ev_el);
} else { } else {
el.insertBefore(ev_el, prior_el); left_overs.push(evid);
} }
} }
model.invalidated = model.invalidated.concat(left_overs); model.invalidated = model.invalidated.concat(left_overs);