-
Notifications
You must be signed in to change notification settings - Fork 282
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
HTML entities are not escaped in @@ lines #324
Comments
This does not only happen with HTML on the @@ line.
(shortened, the whole thing is quite lengthy. The important bit here seems to be, that the diff contains a complete <script></script>-tag that will be rendered to the DOM) |
@ert2 Can you please edit your comment and use triple ` at the start and the end of the code? |
@campersau done. If you consider adressing this issue let me know when I can give any help. |
@ert2 The diff looks ok using the latest version of |
@campersau
|
@campersau When i paste this to the fiddle you set up it renders this: |
@ert2 Thanks, now I can reproduce it: https://jsfiddle.net/hkns8f72/ (You need to escape some characters when using js template literals.) Here is a simpler case: https://jsfiddle.net/znf4yw0g/ when you remove one |
@campersau Thank you for the effort. Do you have any idea what I could do to fix this? I'm reading the diffs from a database and could alter them, but I can't narrow down what exactly causes the problem. Hints on how to approach such a problem in general would be very appreciated as well. (I am by no means a seasoned developer, but I really need to solve this) |
@ert2 You can fix your problem by increasing |
@campersau This works, thank you. Unfortunately it takes ages to calculate :D. Guess I will have to come up with another workaround. |
Released as |
Step 0: Describe your environment
Step 1: Describe the problem:
HTML entities are not escaped in
@@
lines.Steps to reproduce:
Diff2Html.parse
andDiff2Html.html
@@
line is not getting properly escaped which means it is rendered into the browser.diff example:
see above
Observed Results:
The HTML on the
@@
lines gets rendered.Expected Results:
Html should be properly escaped and visible as text only.
Relevant Code:
See https://jsfiddle.net/k28wc6a3/
Original reported here FredrikNoren/ungit#1387
The text was updated successfully, but these errors were encountered: