Quellcode durchsuchen

refactor: drastically simplify JS "has HTML" extension again

Co-authored-by: El RIDO <elrido@gmx.net>
rugk vor 5 Monaten
Ursprung
Commit
7e506c7f83
1 geänderte Dateien mit 3 neuen und 11 gelöschten Zeilen
  1. 3 11
      js/privatebin.js

+ 3 - 11
js/privatebin.js

@@ -962,17 +962,9 @@ jQuery.PrivateBin = (function($) {
          * @returns {boolean}
          */
         function isStringContainsHtml(messageId) {
-            // Use DOMParser to parse the string as HTML. DOMParser does not
-            // execute scripts nor load external resources when parsing, making
-            // it safer against XSS.
-            try {
-                const doc = new DOMParser().parseFromString(String(messageId), 'text/html');
-                return Array.from(doc.body.childNodes).some(node => node.nodeType === Node.ELEMENT_NODE);
-            } catch (e) {
-                // If parsing fails for any reason, consider it not HTML to avoid
-                // treating arbitrary strings as markup.
-                return false;
-            }
+            // message IDs are allowed to contain anchors, spans, keyboard and emphasis tags
+            // we can recognize all of them by only checking for anchors and keyboard tags
+            return args[0].indexOf('<a') !== -1 || args[0].indexOf('<kbd') !== -1;
         }
 
         return me;