fix: sanitize Org previews before trusting rendered HTML

2026-09-12 21:58:57 +02:00 · 2026-09-06 10:46:44 +02:00
parent cf58aa330b
commit b2dfda1838
4 changed files with 11 additions and 3 deletions
@@ -1,6 +1,6 @@
 {
  "core.min.js": "core.6332b3c288.min.js",
-  "vendor.min.js": "vendor.a5d94d956f.min.js",
+  "vendor.min.js": "vendor.1020f4867e.min.js",
  "mermaid.min.js": "mermaid.f848a72d16.min.js",
  "all.min.css": "all.99ce8f3e14.min.css"
 }
@@ -2961,7 +2961,7 @@ angular
                  suppressSubScriptHandling: true,
                  suppressAutoLink: false,
                });
-                $scope.content = $sce.trustAsHtml(orgHTMLDocument.toString());
+                $scope.content = $sce.trustAsHtml(DOMPurify.sanitize(orgHTMLDocument.toString()));
                $scope.type = "html";
              }
              if (