From fbe9aa3506807b5c0f30ea8e877193a0b5ae91a6 Mon Sep 17 00:00:00 2001 From: lain Date: Fri, 23 Mar 2018 19:52:08 +0100 Subject: [PATCH] Strip html from emoji stuff. --- lib/pleroma/formatter.ex | 2 ++ lib/pleroma/web/mastodon_api/views/status_view.ex | 6 +++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/lib/pleroma/formatter.ex b/lib/pleroma/formatter.ex index fdf91f56e..fd8465c1c 100644 --- a/lib/pleroma/formatter.ex +++ b/lib/pleroma/formatter.ex @@ -132,6 +132,8 @@ def emojify(text, additional \\ nil) do end Enum.reduce(all_emoji, text, fn ({emoji, file}, text) -> + emoji = HtmlSanitizeEx.strip_tags(emoji) + file = HtmlSanitizeEx.strip_tags(file) String.replace(text, ":#{emoji}:", "#{emoji}") end) end diff --git a/lib/pleroma/web/mastodon_api/views/status_view.ex b/lib/pleroma/web/mastodon_api/views/status_view.ex index 55675ae1c..170b6ac6c 100644 --- a/lib/pleroma/web/mastodon_api/views/status_view.ex +++ b/lib/pleroma/web/mastodon_api/views/status_view.ex @@ -77,7 +77,11 @@ def render("status.json", %{activity: %{data: %{"object" => object}} = activity} reply_to_user = reply_to && User.get_cached_by_ap_id(reply_to.data["actor"]) emojis = (activity.data["object"]["emoji"] || []) - |> Enum.map(fn {name, url} -> %{ shortcode: name, url: url, static_url: url } end) + |> Enum.map(fn {name, url} -> + name = HtmlSanitizeEx.strip_tags(name) + url = HtmlSanitizeEx.strip_tags(url) + %{ shortcode: name, url: url, static_url: url } + end) %{ id: to_string(activity.id),