3 ms·
Good old unsanitized HTML. Brings memories of the first bulletin boards.
by FranOntanaya 8y ago
Good old unsanitized HTML. Brings memories of the first bulletin boards.
- ycmbntrthrwaway 8y agoIt should have been done via DOM manipulation in the first place. What Signal developers did can be compared to constructing raw SQL requests where parameterized queries suffice. Thankfully, it was just fixed: https://github.com/signalapp/Signal-Desktop/commit/4e5c8965ff72576a9e20850dd30d9985f4073192 https://github.com/signalapp/Signal-Desktop/commit/4e5c8965f...
- rndgermandude 8y agoFrankly, I'm not to eager to trust people writing commit messages like this and then OK that during peer review: https://github.com/signalapp/Signal-Desktop/commit/9d41b8616296f1b328aa864e0114b99d7f11ca06 https://github.com/signalapp/Signal-Desktop/commit/9d41b8616... > Remove escaping from `linkText` > We leverage jQuery’s HTML escaping in `$.html(…)`. ummm.... wat