Escape HTML in profile name preview in profile settings (#9446)

* fix non-escaped html in the profile settings

* provide a default profile text in case if there's no custom one

* update haml syntax

* simplify default profile name to username

* sanitize user-input html but display emojified icons

diff --git a/app/javascript/packs/public.js b/app/javascript/packs/public.js
index 36b1fd26b8da4f4ea9d9a990c4fa4799413725f9..6ba37c049f7dd1b440ab98c8527302b03415eef5 100644 (file)
--- a/app/javascript/packs/public.js
+++ b/app/javascript/packs/public.js
@@ -1,3 +1,4 @@
+import escapeTextContentForBrowser from 'escape-html';
 import loadPolyfills from '../mastodon/load_polyfills';
 import ready from '../mastodon/ready';
 import { start } from '../mastodon/common';
@@ -133,9 +134,12 @@ function main() {
 
   delegate(document, '#account_display_name', 'input', ({ target }) => {
     const name = document.querySelector('.card .display-name strong');
-
     if (name) {
-      name.innerHTML = emojify(target.value);
+      if (target.value) {
+        name.innerHTML = emojify(escapeTextContentForBrowser(target.value));
+      } else {
+        name.textContent = document.querySelector('#default_account_display_name').textContent;
+      }
     }
   });
 

diff --git a/app/views/application/_card.html.haml b/app/views/application/_card.html.haml
index 9cf8f8ff2b59b4e8d9b50256b883ae95747b4525..e6059b03507aa0e7322474cbd973f263fe0ac59b 100644 (file)
--- a/app/views/application/_card.html.haml
+++ b/app/views/application/_card.html.haml
@@ -9,6 +9,7 @@
         = image_tag account.avatar.url, alt: '', width: 48, height: 48, class: 'u-photo'
 
       .display-name
+        %span{id: "default_account_display_name", style: "display:none;"}= account.username
         %bdi
           %strong.emojify.p-name= display_name(account, custom_emojify: true)
         %span