properly escaping HTML in raw text mode, fixes #358

2018-09-02 09:14:36 +02:00
parent fe7fa09ce8
commit 8b71cb0b2f
3 changed files with 3 additions and 3 deletions
--- a/js/privatebin.js
+++ b/js/privatebin.js
@@ -2894,7 +2894,7 @@ jQuery.PrivateBin = (function($, sjcl, Base64, RawDeflate) {
            for (var i = 0; i < $head.length; i++) {
                newDoc.write($head[i].outerHTML);
            }
-            newDoc.write('</head><body><pre>' + DOMPurify.sanitize(paste) + '</pre></body></html>');
+            newDoc.write('</head><body><pre>' + DOMPurify.sanitize($('<div />').text(paste).html()) + '</pre></body></html>');
            newDoc.close();
        }