From 41e2b7b1ab59fefe48cedf49ba82f4e03b646d23 Mon Sep 17 00:00:00 2001 From: Hivert Quentin Date: Wed, 12 Aug 2026 10:53:51 +0200 Subject: [PATCH] fix(bug): escape angularJS only if needed to keep legitimate directive --- UI/MailPartViewers/UIxMailPartICalViewer.m | 11 ++++++++++- UI/MailPartViewers/UIxMailPartViewer.m | 10 ++++++---- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/UI/MailPartViewers/UIxMailPartICalViewer.m b/UI/MailPartViewers/UIxMailPartICalViewer.m index 7775f950a..f7cba20fd 100644 --- a/UI/MailPartViewers/UIxMailPartICalViewer.m +++ b/UI/MailPartViewers/UIxMailPartICalViewer.m @@ -374,6 +374,7 @@ - (iCalEvent *) authorativeEvent { iCalEvent *authorativeEvent; + NSString *comment, *cleanComment; [self storedEvent]; if (!storedEvent @@ -382,6 +383,14 @@ else authorativeEvent = [self storedEvent]; + //Clean authorative event + if ((comment = [authorativeEvent comment])) { + cleanComment = [comment stringWithoutHTMLInjection: NO stripAngular:YES]; + [authorativeEvent setComment: cleanComment]; + } + + + return authorativeEvent; } @@ -587,7 +596,7 @@ //Sanitise the html content if([d objectForKey:@"content"]){ - [d setObject: [[d objectForKey:@"content"] stringWithoutHTMLInjection: NO stripAngular:YES] forKey: @"content"]; + [d setObject: [[d objectForKey:@"content"] stringWithoutHTMLInjection: NO stripAngular:NO] forKey: @"content"]; } return d; diff --git a/UI/MailPartViewers/UIxMailPartViewer.m b/UI/MailPartViewers/UIxMailPartViewer.m index 1e32db42e..38e80422f 100644 --- a/UI/MailPartViewers/UIxMailPartViewer.m +++ b/UI/MailPartViewers/UIxMailPartViewer.m @@ -201,7 +201,7 @@ - content = [[[self generateResponse] contentAsString] stringWithoutHTMLInjection: NO stripAngular:YES]; + content = [[[self generateResponse] contentAsString] stringWithoutHTMLInjection: NO stripAngular:NO]; if ([self respondsToSelector:@selector(getException)]) { e = [self getException]; } @@ -327,10 +327,12 @@ - (NSString *) filenameForDisplay { - NSString *s; + NSString *s, *cleanFilename; - if ((s = [self filename]) != nil) - return s; + if ((s = [self filename]) != nil) { + cleanFilename = [s stringWithoutHTMLInjection: NO stripAngular:YES]; + return cleanFilename; + } s = [partPath componentsJoinedByString:@"-"]; return ([s length] > 0)