tedkulp/PrivateBin
1
0
Fork 0
mirror of https://github.com/PrivateBin/PrivateBin.git synced 2026-03-05 13:30:32 -05:00
Code Issues Packages Projects Releases Wiki Activity

refactor: drastically simplify JS "has HTML" extension again

Browse Source 
Co-authored-by: El RIDO <elrido@gmx.net>
This commit is contained in:
rugk
2026-02-23 16:31:13 +01:00
committed by GitHub
parent ce06857d2c
commit 7e506c7f83
1 changed files with 3 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
js/privatebin.js
View File

@@ -962,17 +962,9 @@ jQuery.PrivateBin = (function($) {
* @returns {boolean}
*/
function isStringContainsHtml(messageId) {
// Use DOMParser to parse the string as HTML. DOMParser does not
// execute scripts nor load external resources when parsing, making
// it safer against XSS.
try {
const doc = new DOMParser().parseFromString(String(messageId), 'text/html');
return Array.from(doc.body.childNodes).some(node => node.nodeType === Node.ELEMENT_NODE);
} catch (e) {
// If parsing fails for any reason, consider it not HTML to avoid
// treating arbitrary strings as markup.
return false;
}
// message IDs are allowed to contain anchors, spans, keyboard and emphasis tags
// we can recognize all of them by only checking for anchors and keyboard tags
return args[0].indexOf('<a') !== -1 || args[0].indexOf('<kbd') !== -1;
}
return me;