Bug #1439

Raw HTML is Shown in Markdown Rendered Text

Added by Pavan Rikhi 11 months ago. Updated 4 months ago.

Status:ClosedStart date:08/08/2019
Priority:NormalDue date:08/08/2019
Assignee:Pavan Rikhi% Done:

100%

Category:UISpent time:-
Target version:v0.7.0 - Misc Pages & UI
Easy Pickings:

Description

Elm 0.18's markdown module would not sanitize any html in a markdown block. The new 0.19 package does this by default, so things like the product/category descriptions are showing the raw HTML.

We can disable the sanitization with the Markdown.toHtmlWith function, but should ensure the backend sanitizes these descriptions when they are saved to the database so malicious <script> tags don't show up.

Or require rewriting descriptions without HTML when we migrate over? I think the only thing we do in HTML that markdown can't handle is red text. But we could add a "warningText" field or something to products that is shown in red above the rendered product descriptions.


Related issues

Duplicated by SESE Website - Bug #1388: Category & Product Pages Show Raw HTML Duplicate

Associated revisions

Revision 849ad381
Added by Pavan Rikhi 4 months ago

[#1439] Properly Render HTML From Model Fields

Replace calls to the Markdown.toHtml function with a new Views.Utils
function, `rawHtml`, which uses the markdown package but disables it's
sanitization process. This allows rendering of the HTML in Product
names, Product/Category descriptions, & StaticPage contents.

Server-side sanitization for these fields will be added to the Admin
pages when they are implemented in a future version.

Closes #1439

History

#1 Updated by Pavan Rikhi 4 months ago

  • Duplicated by Bug #1388: Category & Product Pages Show Raw HTML added

#2 Updated by Pavan Rikhi 4 months ago

Going w/ unsanitized markdown output. Made notes in Admin issues for adding sanitization to fields we currently output the raw HTML for.

#3 Updated by Pavan Rikhi 4 months ago

  • % Done changed from 0 to 100
  • Status changed from New to Closed

#4 Updated by Pavan Rikhi 4 months ago

  • Start date set to 08/08/2019
  • Due date set to 08/08/2019

Also available in: Atom PDF