Remove innerHTML from user-additions.js.

1 files changed, 16 insertions, 11 deletions

diff --git a/static/user/user-additions.js b/static/user/user-additions.js
index 6d944b86..c9ebe1a4 100644
--- a/static/user/user-additions.js
+++ b/static/user/user-additions.js
@@ -5,17 +5,22 @@ window.formatters.set('description', (el, d) => {
         let doc = parser.parseFromString(d, 'text/html');
         el.replaceChildren(doc.body);
     } else {
-        /* Otherwise it should be plain(er) text, parse "all" links
-           (and reserved XML characters)
-        */
-        // TODO replace with something that doesn't use innerHTML */
-        el.innerHTML = d
-            .replaceAll(/</g, '&lt;')
-            .replaceAll(/>/g, '&gt;')
-            .replaceAll(/&/g, '&amp;')
-            .replaceAll(/'/g, '&apos;')
-            .replaceAll(/"/g, '&quot;')
-            .replaceAll(/https?:\/\/\S+/g, '<a href="$&">$&</a>')
+        /* Otherwise it should be plain(er) text, parse "all" links */
+        let rx = /https?:\/\/\S+/g
+        let idx = 0;
+        let children = []
+        for (let match of d.matchAll(rx)) {
+            let anch = document.createElement('a')
+            anch.href = match[0]
+            anch.textContent = match[0]
+
+            children.push(d.substring(idx, match.index))
+            children.push(anch)
+
+            idx = match.index + match[0].length
+        }
+        children.push(d.substring(idx))
+        el.replaceChildren(...children);
     }
 })