Cavemanon/piratepoet
8
Fork 0
Code Pull Requests Actions Releases 16 Activity

Use toString instead of html

Browse Source 
The content saved to the database already encodes content that needs
encoding, e.g. <script> tags. The problem with pQuery's `html` method is
 it decodes everything. By using toString instead, we should be getting
 the same contents that were saved to the database.

MAILPOET-5632
This commit is contained in:
John Oleksowicz
2023-10-10 10:22:30 -05:00
committed by Aschepikov
parent efc80b0476
commit dae1cb19a8
2 changed files with 38 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
mailpoet/lib/Newsletter/Renderer/Blocks/Text.php
View File

@@ -38,7 +38,7 @@ class Text {
if (preg_match('/h\d/', $paragraph->getTag())) {
$contents[] = $paragraph->getOuterText();
} else {
$contents[] = str_replace('&', '&amp;', $paragraph->html());
$contents[] = $paragraph->toString(true, true, 1);
}
if ($index + 1 < $paragraphs->count()) $contents[] = '<br />';
$paragraph->remove();
@@ -105,7 +105,7 @@ class Text {
if (!preg_match('/text-align/i', $style)) {
$style = 'text-align: left;' . $style;
}
$contents = str_replace('&', '&amp;', $paragraph->html());
$contents = $paragraph->toString(true, true, 1);
$paragraph->setTag('table');
$paragraph->style = 'border-spacing:0;mso-table-lspace:0;mso-table-rspace:0;';
$paragraph->width = '100%';
@@ -144,7 +144,7 @@ class Text {
if (!$lists->count()) return $html;
foreach ($lists as $list) {
if ($list->tag === 'li') {
$list->setInnertext(str_replace('&', '&amp;', $list->html()));
$list->setInnertext($list->toString(true, true, 1));
$list->class = 'mailpoet_paragraph';
} else {
$list->class = 'mailpoet_paragraph';

35
mailpoet/tests/unit/Newsletter/Renderer/Blocks/TextTest.php
View File

@@ -185,4 +185,39 @@ class TextTest extends \MailPoetUnitTest {
$output = (new Text)->render($this->block);
expect($output)->stringNotContainsString('<br />');
}
public function htmlEntitiesStrings() {
return [
'paragraph' => ["<p>Text &lt;script&gt;alert('test');&lt;/script&gt;</p>"],
'list' => ["<ul>Text &lt;script&gt;alert('test');&lt;/script&gt;</li></ul>"],
'blockquote' => ["<ul>Text &lt;script&gt;alert('test');&lt;/script&gt;</li></ul>"],
];
}
/**
* @dataProvider htmlEntitiesStrings
*/
public function testItDoesNotDecodeHtmlEntities($htmlString) {
$this->block['text'] = $htmlString;
$output = (new Text())->render($this->block);
expect($output)->stringNotContainsString('<script>');
expect($output)->stringContainsString("&lt;script&gt;alert('test');&lt;/script&gt;");
}
public function childElementStrings(): array {
return [
'paragraph' => ['<p><a href="https://example.com">Link</a></p>'],
'list' => ['<p><ul><li><a href="https://example.com">Link</li></ul></a></p>'],
'blockquote' => ['<blockquote><p><a href="https://example.com">Link</a></p></blockquote>'],
];
}
/**
* @dataProvider childElementStrings
*/
public function testItMaintainsHtmlInChildElements($htmlString) {
$this->block['text'] = $htmlString;
$output = (new Text())->render($this->block);
expect($output)->stringContainsString('<a href="https://example.com">Link</a>');
}
}