VeritableValor/invidious
1
0
Fork 0
mirror of https://github.com/iv-org/invidious.git synced 2026-08-17 05:20:51 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix(comments): HTML escape emoji alt text to prevent attribute injection

Browse Source
This commit is contained in:
Test User 2026-08-08 15:16:32 -04:00
parent b313d2cf71
commit 2ea9a8e6d9
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/invidious/comments/content.cr
View File

@ -64,7 +64,7 @@ def content_to_comment_html(content, video_id : String? = "")
# check for custom emojis # check for custom emojis
if run["emoji"]? if run["emoji"]?
if emoji_image = run.dig?("emoji", "image") if emoji_image = run.dig?("emoji", "image")
emoji_alt = emoji_image.dig?("accessibility", "accessibilityData", "label").try &.as_s || text emoji_alt = HTML.escape(emoji_image.dig?("accessibility", "accessibilityData", "label").try(&.as_s) || text)
emoji_thumb = emoji_image["thumbnails"][0] emoji_thumb = emoji_image["thumbnails"][0]
text = String.build do |str| text = String.build do |str|
str << %(<img alt=") << emoji_alt << "\" " str << %(<img alt=") << emoji_alt << "\" "