fix(kbe): sanitize Markdown without HTML entities (#185)

eurofurence · Aug 27, 2024 · d35a209 · d35a209
1 parent 668a076
commit d35a209
Showing 1 changed file with 5 additions and 4 deletions.
diff --git a/src/Eurofurence.App.Server.Services/Knowledge/KnowledgeEntryService.cs b/src/Eurofurence.App.Server.Services/Knowledge/KnowledgeEntryService.cs
@@ -2,6 +2,7 @@
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
+using System.Web;
 using Eurofurence.App.Domain.Model.Knowledge;
 using Eurofurence.App.Domain.Model.Sync;
 using Eurofurence.App.Infrastructure.EntityFramework;
@@ -68,8 +69,8 @@ public async Task<KnowledgeEntryRecord> InsertKnowledgeEntryAsync(
             {
                 Id = request.Id,
                 KnowledgeGroupId = request.KnowledgeGroupId,
-                Title = _htmlSanitizer.Sanitize(request.Title),
-                Text = _htmlSanitizer.Sanitize(request.Text),
+                Title = request.Title,
+                Text = HttpUtility.HtmlDecode(_htmlSanitizer.Sanitize(request.Text)),
                 Order = request.Order,
                 Links = request.Links,
                 IsDeleted = 0
@@ -95,8 +96,8 @@ public async Task<KnowledgeEntryRecord> ReplaceKnowledgeEntryAsync(
                 .FirstOrDefaultAsync(ke => ke.Id == id, cancellationToken);
 
             existingEntity.KnowledgeGroupId = request.KnowledgeGroupId;
-            existingEntity.Title = _htmlSanitizer.Sanitize(request.Title);
-            existingEntity.Text = _htmlSanitizer.Sanitize(request.Text);
+            existingEntity.Title = request.Title;
+            existingEntity.Text = HttpUtility.HtmlDecode(_htmlSanitizer.Sanitize(request.Text));
             existingEntity.Order = request.Order;
 
             foreach (var existingLink in existingEntity.Links)