diff --git a/components/BigDumbMarkdown.tsx b/components/BigDumbMarkdown.tsx index 2bc3c7d0f..4d3af8115 100644 --- a/components/BigDumbMarkdown.tsx +++ b/components/BigDumbMarkdown.tsx @@ -1,11 +1,11 @@ -import escapeHTML from 'escape-html' +import xss from 'xss' import markdownStyles from './markdown-styles.module.css' export default function BigDumbMarkdown({ content }: { content: string }) { return (
-
+
) diff --git a/package-lock.json b/package-lock.json index 8f3534231..b07eb429e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -40,7 +40,8 @@ "stripe": "^15.9.0", "swr": "^2.2.5", "watch": "^0.13.0", - "wicg-inert": "^3.1.2" + "wicg-inert": "^3.1.2", + "xss": "^1.0.15" }, "devDependencies": { "@tailwindcss/line-clamp": "^0.4.4", @@ -2094,6 +2095,11 @@ "node": ">=4" } }, + "node_modules/cssfilter": { + "version": "0.0.10", + "resolved": "https://registry.npmjs.org/cssfilter/-/cssfilter-0.0.10.tgz", + "integrity": "sha512-FAaLDaplstoRsDR8XGYH51znUN0UY7nMc6Z9/fvE8EXGwvJE9hu7W2vHwx1+bd6gCYnln9nLbzxFTrcO9YQDZw==" + }, "node_modules/csstype": { "version": "3.1.1", "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.1.1.tgz", @@ -7656,6 +7662,26 @@ "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==", "dev": true }, + "node_modules/xss": { + "version": "1.0.15", + "resolved": "https://registry.npmjs.org/xss/-/xss-1.0.15.tgz", + "integrity": "sha512-FVdlVVC67WOIPvfOwhoMETV72f6GbW7aOabBC3WxN/oUdoEMDyLz4OgRv5/gck2ZeNqEQu+Tb0kloovXOfpYVg==", + "dependencies": { + "commander": "^2.20.3", + "cssfilter": "0.0.10" + }, + "bin": { + "xss": "bin/xss" + }, + "engines": { + "node": ">= 0.10.0" + } + }, + "node_modules/xss/node_modules/commander": { + "version": "2.20.3", + "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz", + "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==" + }, "node_modules/yaml": { "version": "2.4.3", "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.4.3.tgz", @@ -8935,6 +8961,11 @@ "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==", "dev": true }, + "cssfilter": { + "version": "0.0.10", + "resolved": "https://registry.npmjs.org/cssfilter/-/cssfilter-0.0.10.tgz", + "integrity": "sha512-FAaLDaplstoRsDR8XGYH51znUN0UY7nMc6Z9/fvE8EXGwvJE9hu7W2vHwx1+bd6gCYnln9nLbzxFTrcO9YQDZw==" + }, "csstype": { "version": "3.1.1", "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.1.1.tgz", @@ -12776,6 +12807,22 @@ "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==", "dev": true }, + "xss": { + "version": "1.0.15", + "resolved": "https://registry.npmjs.org/xss/-/xss-1.0.15.tgz", + "integrity": "sha512-FVdlVVC67WOIPvfOwhoMETV72f6GbW7aOabBC3WxN/oUdoEMDyLz4OgRv5/gck2ZeNqEQu+Tb0kloovXOfpYVg==", + "requires": { + "commander": "^2.20.3", + "cssfilter": "0.0.10" + }, + "dependencies": { + "commander": { + "version": "2.20.3", + "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz", + "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==" + } + } + }, "yaml": { "version": "2.4.3", "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.4.3.tgz", diff --git a/package.json b/package.json index 06977cb83..4b5ffe8a6 100644 --- a/package.json +++ b/package.json @@ -42,7 +42,8 @@ "stripe": "^15.9.0", "swr": "^2.2.5", "watch": "^0.13.0", - "wicg-inert": "^3.1.2" + "wicg-inert": "^3.1.2", + "xss": "^1.0.15" }, "devDependencies": { "@tailwindcss/line-clamp": "^0.4.4", diff --git a/pages/projects/[slug].tsx b/pages/projects/[slug].tsx index cf395f6d9..15802e96e 100644 --- a/pages/projects/[slug].tsx +++ b/pages/projects/[slug].tsx @@ -15,7 +15,7 @@ import Link from 'next/link' import ShareButtons from '../../components/ShareButtons' import Progress from '../../components/Progress' import { fetchPostJSON, fetchGetJSONAuthedBTCPay, fetchGetJSONAuthedStripe } from '../../utils/api-helpers' -import escapeHTML from 'escape-html' +import xss from 'xss' type SingleProjectPageProps = { project: ProjectItem @@ -138,7 +138,7 @@ const Project: NextPage = ({ project, projects, stats })


- {content &&
} + {content &&
}