diff --git a/src-ui/src/app/pipes/markdown.pipe.ts b/src-ui/src/app/pipes/markdown.pipe.ts index 492cce77b..1b6c39274 100644 --- a/src-ui/src/app/pipes/markdown.pipe.ts +++ b/src-ui/src/app/pipes/markdown.pipe.ts @@ -1,21 +1,21 @@ import { Pipe, PipeTransform } from '@angular/core' import { Marked, Renderer, Tokens } from 'marked' -const ALLOWED_LINK_PROTOCOLS = ['http:', 'https:', 'mailto:'] +const ALLOWED_LINK_PROTOCOLS = new Set(['http:', 'https:', 'mailto:']) function escapeHtml(text: string): string { return text - .replace(/&/g, '&') - .replace(//g, '>') - .replace(/"/g, '"') - .replace(/'/g, ''') + .replaceAll('&', '&') + .replaceAll('<', '<') + .replaceAll('>', '>') + .replaceAll('"', '"') + .replaceAll("'", ''') } function safeHref(href: string): string | null { try { const url = new URL(href) - return ALLOWED_LINK_PROTOCOLS.includes(url.protocol) ? url.href : null + return ALLOWED_LINK_PROTOCOLS.has(url.protocol) ? url.href : null } catch { return null }