Properly escape HTML in every Scribe actions
In recent commits I separated how we could add text in the editor. So we need to escape HTML in both method that add text: insertTextInEditor and setTextInEditor. I had to extract the HTML escape part of convertTextContentToHtmlContent because when using setTextInEditor we do not need to convert \n to <br>.
This commit is contained in:
@@ -251,16 +251,14 @@ class StringConvert {
|
||||
}
|
||||
}
|
||||
|
||||
static String convertTextContentToHtmlContent(String textContent) {
|
||||
// Escape HTML entities first to prevent interpretation as HTML
|
||||
final escapedContent = textContent
|
||||
.replaceAll('&', '&')
|
||||
.replaceAll('<', '<')
|
||||
.replaceAll('>', '>')
|
||||
.replaceAll('"', '"')
|
||||
.replaceAll("'", ''');
|
||||
static String escapeTextContent(String textContent) {
|
||||
const HtmlEscape htmlEscape = HtmlEscape();
|
||||
|
||||
final htmlContent = escapedContent.replaceAll('\n', '<br>');
|
||||
return htmlEscape.convert(textContent);
|
||||
}
|
||||
|
||||
static String convertTextContentToHtmlContent(String textContent) {
|
||||
final htmlContent = textContent.replaceAll('\n', '<br>');
|
||||
|
||||
return '<div>$htmlContent</div>';
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user