Merge pull request #1698 from floccusaddon/fix/htmlentities

fix: Encode unsafe characters as HTML entities
floccusaddon · Aug 18, 2024 · 35191ba · 35191ba
2 parents 8161425 + f82cdc1
commit 35191ba
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 4 deletions.
diff --git a/src/lib/serializers/Html.ts b/src/lib/serializers/Html.ts
@@ -7,17 +7,21 @@ class HtmlSerializer implements Serializer {
     return `<DL><p>\n${this._serializeFolder(folder, '')}</DL><p>\n`
   }
 
+  _htmlentities_encode(string) {
+    return string.replace(/[\u00A0-\u9999<>&"]/g, char => '&#' + char.charCodeAt(0) + ';')
+  }
+
   _serializeFolder(folder, indent) {
     return folder.children
       .map(child => {
         if (child instanceof Bookmark) {
           return (
-            `${indent}<DT><A HREF="${child.url}" TAGS="${''}" ID="${child.id}">${child.title}</A>\n`
+            `${indent}<DT><A HREF="${this._htmlentities_encode(child.url)}" TAGS="${''}" ID="${child.id}">${this._htmlentities_encode(child.title)}</A>\n`
           )
         } else if (child instanceof Folder) {
           const nextIndent = indent + '  '
           return (
-            `${indent}<DT><H3 ID="${child.id}">${child.title}</H3>\n` +
+            `${indent}<DT><H3 ID="${child.id}">${this._htmlentities_encode(child.title)}</H3>\n` +
             `${indent}<DL><p>\n${this._serializeFolder(
               child,
               nextIndent

diff --git a/src/test/test.js b/src/test/test.js
@@ -1105,7 +1105,7 @@ describe('Floccus', function() {
               parentId: localRoot
             })
             const barFolder = await browser.bookmarks.create({
-              title: "bar=?*'Ä_:-^;",
+              title: "bar=?*'Ä_:-^;<script>",
               parentId: fooFolder.id
             })
             const bookmark = await browser.bookmarks.create({
@@ -1129,7 +1129,7 @@ describe('Floccus', function() {
                     title: 'foo!"§$%&/()=?"',
                     children: [
                       new Folder({
-                        title: "bar=?*'Ä_:-^;",
+                        title: "bar=?*'Ä_:-^;<script>",
                         children: [
                           new Bookmark({
                             title: 'url|!"=)/§_:;Ä\'*ü"',