Merge pull request #1190 from MrPetovan/bug/10634-markdown-html

[markdown] Escape HTML characters before running Markdown::toBBCode()
pull/1193/head
Tobias Diekershoff 2021-10-14 09:56:35 +02:00 committed by GitHub
commit c22cb063d7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 0 deletions

View File

@ -56,6 +56,10 @@ function markdown_post_local_start(App $a, &$request) {
// Escape mentions which username can contain Markdown-like characters
// See https://github.com/friendica/friendica/issues/9486
return \Friendica\Util\Strings::performWithEscapedBlocks($body, '/[@!][^@\s]+@[^\s]+\w/', function ($text) {
// Markdown accepts literal HTML but we do not in post body, so we need to escape all chevrons
// See https://github.com/friendica/friendica/issues/10634
$text = \Friendica\Util\Strings::escapeHtml($text);
return Markdown::toBBCode($text);
});
}