diff --git a/components/BigDumbMarkdown.tsx b/components/BigDumbMarkdown.tsx
index 2bc3c7d0f..4d3af8115 100644
--- a/components/BigDumbMarkdown.tsx
+++ b/components/BigDumbMarkdown.tsx
@@ -1,11 +1,11 @@
-import escapeHTML from 'escape-html'
+import xss from 'xss'
import markdownStyles from './markdown-styles.module.css'
export default function BigDumbMarkdown({ content }: { content: string }) {
return (
)
diff --git a/package-lock.json b/package-lock.json
index 8f3534231..b07eb429e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -40,7 +40,8 @@
"stripe": "^15.9.0",
"swr": "^2.2.5",
"watch": "^0.13.0",
- "wicg-inert": "^3.1.2"
+ "wicg-inert": "^3.1.2",
+ "xss": "^1.0.15"
},
"devDependencies": {
"@tailwindcss/line-clamp": "^0.4.4",
@@ -2094,6 +2095,11 @@
"node": ">=4"
}
},
+ "node_modules/cssfilter": {
+ "version": "0.0.10",
+ "resolved": "https://registry.npmjs.org/cssfilter/-/cssfilter-0.0.10.tgz",
+ "integrity": "sha512-FAaLDaplstoRsDR8XGYH51znUN0UY7nMc6Z9/fvE8EXGwvJE9hu7W2vHwx1+bd6gCYnln9nLbzxFTrcO9YQDZw=="
+ },
"node_modules/csstype": {
"version": "3.1.1",
"resolved": "https://registry.npmjs.org/csstype/-/csstype-3.1.1.tgz",
@@ -7656,6 +7662,26 @@
"integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
"dev": true
},
+ "node_modules/xss": {
+ "version": "1.0.15",
+ "resolved": "https://registry.npmjs.org/xss/-/xss-1.0.15.tgz",
+ "integrity": "sha512-FVdlVVC67WOIPvfOwhoMETV72f6GbW7aOabBC3WxN/oUdoEMDyLz4OgRv5/gck2ZeNqEQu+Tb0kloovXOfpYVg==",
+ "dependencies": {
+ "commander": "^2.20.3",
+ "cssfilter": "0.0.10"
+ },
+ "bin": {
+ "xss": "bin/xss"
+ },
+ "engines": {
+ "node": ">= 0.10.0"
+ }
+ },
+ "node_modules/xss/node_modules/commander": {
+ "version": "2.20.3",
+ "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+ "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ=="
+ },
"node_modules/yaml": {
"version": "2.4.3",
"resolved": "https://registry.npmjs.org/yaml/-/yaml-2.4.3.tgz",
@@ -8935,6 +8961,11 @@
"integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
"dev": true
},
+ "cssfilter": {
+ "version": "0.0.10",
+ "resolved": "https://registry.npmjs.org/cssfilter/-/cssfilter-0.0.10.tgz",
+ "integrity": "sha512-FAaLDaplstoRsDR8XGYH51znUN0UY7nMc6Z9/fvE8EXGwvJE9hu7W2vHwx1+bd6gCYnln9nLbzxFTrcO9YQDZw=="
+ },
"csstype": {
"version": "3.1.1",
"resolved": "https://registry.npmjs.org/csstype/-/csstype-3.1.1.tgz",
@@ -12776,6 +12807,22 @@
"integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
"dev": true
},
+ "xss": {
+ "version": "1.0.15",
+ "resolved": "https://registry.npmjs.org/xss/-/xss-1.0.15.tgz",
+ "integrity": "sha512-FVdlVVC67WOIPvfOwhoMETV72f6GbW7aOabBC3WxN/oUdoEMDyLz4OgRv5/gck2ZeNqEQu+Tb0kloovXOfpYVg==",
+ "requires": {
+ "commander": "^2.20.3",
+ "cssfilter": "0.0.10"
+ },
+ "dependencies": {
+ "commander": {
+ "version": "2.20.3",
+ "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+ "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ=="
+ }
+ }
+ },
"yaml": {
"version": "2.4.3",
"resolved": "https://registry.npmjs.org/yaml/-/yaml-2.4.3.tgz",
diff --git a/package.json b/package.json
index 06977cb83..4b5ffe8a6 100644
--- a/package.json
+++ b/package.json
@@ -42,7 +42,8 @@
"stripe": "^15.9.0",
"swr": "^2.2.5",
"watch": "^0.13.0",
- "wicg-inert": "^3.1.2"
+ "wicg-inert": "^3.1.2",
+ "xss": "^1.0.15"
},
"devDependencies": {
"@tailwindcss/line-clamp": "^0.4.4",
diff --git a/pages/projects/[slug].tsx b/pages/projects/[slug].tsx
index cf395f6d9..15802e96e 100644
--- a/pages/projects/[slug].tsx
+++ b/pages/projects/[slug].tsx
@@ -15,7 +15,7 @@ import Link from 'next/link'
import ShareButtons from '../../components/ShareButtons'
import Progress from '../../components/Progress'
import { fetchPostJSON, fetchGetJSONAuthedBTCPay, fetchGetJSONAuthedStripe } from '../../utils/api-helpers'
-import escapeHTML from 'escape-html'
+import xss from 'xss'
type SingleProjectPageProps = {
project: ProjectItem
@@ -138,7 +138,7 @@ const Project: NextPage = ({ project, projects, stats })
- {content && }
+ {content && }