thegamer/Cable-Desktop
2
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Fix tests, let templating handle html escaping

Browse source 
Note: as a Chrome app, we're also protected from xss by the content
security policy.

// FREEBIE
This commit is contained in:
lilia 2015-07-04 23:08:25 -07:00
parent fcc873ffca
commit f5f4c128f9
2 changed files with 4 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
background.html
View file

@ -65,7 +65,7 @@
{{> avatar }}
<div class="bubble">
<div class='attachments'></div>
<p class="content">{{& message }}</p>
<p class="content">{{ message }}</p>
<div class='meta'>
<span class='timestamp'>{{ timestamp }}</span>
<span class='checkmark hide'>✓</span>

13
js/views/message_view.js
View file

@ -52,19 +52,11 @@
this.$el.removeClass('control');
}
},
autoLink: function(text) {
return text.replace(/(^|[\s\n]|<br\/?>)((?:https?|ftp):\/\/[\-A-Z0-9+\u0026\u2019@#\/%?=()~_|!:,.;]*[\-A-Z0-9+\u0026@#\/%=~()_|])/gi, "$1<a href='$2' target='_blank'>$2</a>");
},
sanitizeMessage: function (message) {
var element = document.createElement('span');
element.innerText = message;
return element.innerHTML.trim().replace(/\n/g, '<br>');
},
render: function() {
var contact = this.model.getContact();
this.$el.html(
Mustache.render(this.template, {
message: this.sanitizeMessage(this.model.get('body')),
message: this.model.get('body'),
timestamp: moment(this.model.get('sent_at')).fromNow(),
sender: (contact && contact.getTitle()) || '',
avatar: (contact && contact.getAvatar())
@ -74,7 +66,8 @@
twemoji.parse(this.el, { base: '/images/twemoji/', size: 16 });
var content = this.$('.content');
content.html(this.autoLink(content.html()));
var escaped = content.html();
content.html(escaped.replace(/\n/g, '<br>').replace(/(^|[\s\n]|<br\/?>)((?:https?|ftp):\/\/[\-A-Z0-9+\u0026\u2019@#\/%?=()~_|!:,.;]*[\-A-Z0-9+\u0026@#\/%=~()_|])/gi, "$1<a href='$2' target='_blank'>$2</a>"));
this.renderDelivered();
this.renderPending();