[IM] Prevent XSS / JS interpretation in preview boxes [ref: 555-9-9]

inex · Oct 21, 2022 · 083d17e · 083d17e
1 parent 2889be9
commit 083d17e
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/Http/Controllers/Api/V4/UtilsController.php b/app/Http/Controllers/Api/V4/UtilsController.php
@@ -54,7 +54,7 @@ public function markdown( Request $r ): JsonResponse
  {
  $pd = new Parsedown();
  return response()->json([
- 'html' => $pd->text( $r->text )
+ 'html' => htmlspecialchars( $pd->text( $r->text ) )
  ]);
  }
 }