Invert conatainsLink logic

js/privatebin.js

@@ -453,11 +453,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
          * @return string escaped HTML
          */
         me.htmlEntities = function(str) {
-            // using textarea, since other tags may allow and execute scripts, even when detached from DOM
-            let holder = document.createElement('textarea');
-            holder.textContent = str;
-            // as per OWASP recommendation, also encoding quotes and slash
-            return holder.innerHTML.replace(
+            return str.replace(
                 /["'\/]/g,
                 function(s) {
                     return {
@@ -629,10 +625,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
 
             // if $element is given, apply text to element
             if ($element !== null) {
-                if (!containsLinks) {
-                    // avoid HTML entity encoding if translation contains links
-                    $element.text(output);
-                } else {
+                if (containsLinks) {
                     // only allow tags/attributes we actually use in our translations
                     $element.html(
                         DOMPurify.sanitize(output, {
@@ -640,6 +633,9 @@ jQuery.PrivateBin = (function($, RawDeflate) {
                             ALLOWED_ATTR: ['href', 'id']
                         })
                     );
+                } else {
+                    // avoid HTML entity encoding if translation contains no links
+                    $element.text(output);                    
                 }
             }
 

tpl/bootstrap.php

@@ -72,7 +72,7 @@ endif;
 ?>
 		<script type="text/javascript" data-cfasync="false" src="js/purify-2.0.7.js" integrity="sha512-XjNEK1xwh7SJ/7FouwV4VZcGW9cMySL3SwNpXgrURLBcXXQYtZdqhGoNdEwx9vwLvFjUGDQVNgpOrTsXlSTiQg==" crossorigin="anonymous"></script>
 		<script type="text/javascript" data-cfasync="false" src="js/legacy.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-LYos+qXHIRqFf5ZPNphvtTB0cgzHUizu2wwcOwcwz/VIpRv9lpcBgPYz4uq6jx0INwCAj6Fbnl5HoKiLufS2jg==" crossorigin="anonymous"></script>
-		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-NQ2iciSmIAeXCmdpJm5BGKvyGjkvN0Ob82mmbxSpgBpJpLypKZEQksbkIti+dyQ3XVjXIGyi9yiLxEgvpzG3hw==" crossorigin="anonymous"></script>
+		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-ltd0JKLy8oXq5y1v6qXEy0v9wpLFhU7j+uwnGVeEqmsidw20tCtVz5IM5fStMMede2690e4CIvDjCSS86k4b2g==" crossorigin="anonymous"></script>
 		<link rel="apple-touch-icon" href="img/apple-touch-icon.png?<?php echo rawurlencode($VERSION); ?>" sizes="180x180" />
 		<link rel="icon" type="image/png" href="img/favicon-32x32.png?<?php echo rawurlencode($VERSION); ?>" sizes="32x32" />
 		<link rel="icon" type="image/png" href="img/favicon-16x16.png?<?php echo rawurlencode($VERSION); ?>" sizes="16x16" />

tpl/page.php

@@ -50,7 +50,7 @@ endif;
 ?>
 		<script type="text/javascript" data-cfasync="false" src="js/purify-2.0.7.js" integrity="sha512-XjNEK1xwh7SJ/7FouwV4VZcGW9cMySL3SwNpXgrURLBcXXQYtZdqhGoNdEwx9vwLvFjUGDQVNgpOrTsXlSTiQg==" crossorigin="anonymous"></script>
 		<script type="text/javascript" data-cfasync="false" src="js/legacy.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-LYos+qXHIRqFf5ZPNphvtTB0cgzHUizu2wwcOwcwz/VIpRv9lpcBgPYz4uq6jx0INwCAj6Fbnl5HoKiLufS2jg==" crossorigin="anonymous"></script>
-		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-NQ2iciSmIAeXCmdpJm5BGKvyGjkvN0Ob82mmbxSpgBpJpLypKZEQksbkIti+dyQ3XVjXIGyi9yiLxEgvpzG3hw==" crossorigin="anonymous"></script>
+		<script type="text/javascript" data-cfasync="false" src="js/privatebin.js?<?php echo rawurlencode($VERSION); ?>" integrity="sha512-ltd0JKLy8oXq5y1v6qXEy0v9wpLFhU7j+uwnGVeEqmsidw20tCtVz5IM5fStMMede2690e4CIvDjCSS86k4b2g==" crossorigin="anonymous"></script>
 		<link rel="apple-touch-icon" href="img/apple-touch-icon.png?<?php echo rawurlencode($VERSION); ?>" sizes="180x180" />
 		<link rel="icon" type="image/png" href="img/favicon-32x32.png?<?php echo rawurlencode($VERSION); ?>" sizes="32x32" />
 		<link rel="icon" type="image/png" href="img/favicon-16x16.png?<?php echo rawurlencode($VERSION); ?>" sizes="16x16" />