diff --git a/js/privatebin.js b/js/privatebin.js index 77e458fb..86b6046e 100644 --- a/js/privatebin.js +++ b/js/privatebin.js @@ -1766,8 +1766,9 @@ jQuery.PrivateBin = function($, sjcl, Base64, RawDeflate) { } // set text - Helper.setElementText($plainText, text); - Helper.setElementText($prettyPrint, text); + var sanitizedText = DOMPurify.sanitize(text, {SAFE_FOR_JQUERY: true}) + Helper.setElementText($plainText, sanitizedText); + Helper.setElementText($prettyPrint, sanitizedText); switch (format) { case 'markdown': @@ -1792,7 +1793,7 @@ jQuery.PrivateBin = function($, sjcl, Base64, RawDeflate) { $prettyPrint.html( prettyPrintOne( - Helper.htmlEntities(text), null, true + Helper.htmlEntities(sanitizedText), null, true ) ); // fall through, as the rest is the same @@ -1800,16 +1801,6 @@ jQuery.PrivateBin = function($, sjcl, Base64, RawDeflate) { // convert URLs to clickable links Helper.urls2links($plainText); Helper.urls2links($prettyPrint); - $plainText.html( - DOMPurify.sanitize( - $plainText.html(), {SAFE_FOR_JQUERY: true} - ) - ); - $prettyPrint.html( - DOMPurify.sanitize( - $prettyPrint.html(), {SAFE_FOR_JQUERY: true} - ) - ); $prettyPrint.css('white-space', 'pre-wrap'); $prettyPrint.css('word-break', 'normal'); diff --git a/tpl/bootstrap.php b/tpl/bootstrap.php index aee95830..89cd4ff6 100644 --- a/tpl/bootstrap.php +++ b/tpl/bootstrap.php @@ -70,7 +70,7 @@ if ($MARKDOWN): - + diff --git a/tpl/page.php b/tpl/page.php index 1d7355bf..c59fba71 100644 --- a/tpl/page.php +++ b/tpl/page.php @@ -48,7 +48,7 @@ if ($MARKDOWN): - +