From 1ebaa3d46ca945d6adfa3a97599a82ea7861a77f Mon Sep 17 00:00:00 2001 From: Ben Gotow Date: Mon, 1 Jan 2024 11:49:18 -0600 Subject: [PATCH] Fix escaping of subject and participant names in the print modal --- .../print/lib/print-window.ts | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/app/internal_packages/print/lib/print-window.ts b/app/internal_packages/print/lib/print-window.ts index 00b73a3de..612092e5c 100644 --- a/app/internal_packages/print/lib/print-window.ts +++ b/app/internal_packages/print/lib/print-window.ts @@ -2,6 +2,7 @@ import path from 'path'; import fs from 'fs'; import { localized } from 'mailspring-exports'; +import { escapeHTML } from 'underscore.string'; const { app, BrowserWindow, dialog } = require('@electron/remote'); @@ -21,7 +22,9 @@ export default class PrintWindow { const stylesPath = path.join(__dirname, '..', 'static', 'print-styles.css'); const participantsHtml = participants .map(part => { - return `
  • ${part.name || ''} <${part.email}>
    • `; + return `
  • + ${escapeHTML(part.name || '')} <${escapeHTML(part.email)}> +
    • `; }) .join(''); @@ -29,7 +32,7 @@ export default class PrintWindow { - + ${styleTags} @@ -42,21 +45,23 @@ export default class PrintWindow {
    - ${localized('Close')} + ${escapeHTML(localized('Close'))}
    - +
    -

    ${subject}

    +

    ${escapeHTML(subject)}