nextcloud-libraries / nextcloud-libraries/nextcloud-vue
`richEditor` mixin doesn't parse special symbols (normal and escaped) properly
Nobody has claimed this yet.
- Dominant language
- Vue
- Stars
- 246
- Forks
- 99
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 103
Description
Source: https://github.com/nextcloud-libraries/nextcloud-vue/blob/69959c3135c2ceda8cf03191f9ba3c1e8d50a0c8/src/mixins/richEditor/index.js#L51
https://github.com/nextcloud-libraries/nextcloud-vue/blob/69959c3135c2ceda8cf03191f9ba3c1e8d50a0c8/src/mixins/richEditor/index.js#L85
When it comes to using renderContent(), it escapes string content, and then tries to restore it
| Input | Expected | Output |
|---|---|---|
this.renderContent('<span>test</span>') |
<span>test</span> |
<span>test</span> |
this.renderContent('`<span>test</span>`') |
<span>test</span> |
<span>test</span> |
this.renderContent('<span>test</span>') |
<span>test</span> |
&lt;span&gt;test&lt;/span&gt |
this.renderContent('`<span>test</span>') |
<span>test</span> |
&lt;span&gt;test&lt;/span&gt |
Modifying function like that:
.join('')
.replace(/\n/gmi, '<br>')
.replace(/&/gmi, '&')
+ .replace(/&/gmi, '&')
helps a bit, but then it comes to using together with parseContent(), second function strips all HTML-tag-alike content due to security reasons
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with src/mixins/richEditor/index.js at the renderContent() references around lines 51 and 85, then inspect how parseContent() handles the resulting HTML-like content. Reproduce the four input/output cases from the issue and verify that normal and escaped symbols render as expected without allowing parseContent() to strip or permit unsafe tag-like content.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100