From a7ff0a1948b874c4171fd424698be033c74d333d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hugo=20H=C3=B6rnquist?= <hugo@lysator.liu.se>
Date: Thu, 31 Mar 2022 03:55:26 +0200
Subject: Remove innerHTML from user-additions.js.

---
 static/user/user-additions.js | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/static/user/user-additions.js b/static/user/user-additions.js
index 6d944b86..c9ebe1a4 100644
--- a/static/user/user-additions.js
+++ b/static/user/user-additions.js
@@ -5,17 +5,22 @@ window.formatters.set('description', (el, d) => {
         let doc = parser.parseFromString(d, 'text/html');
         el.replaceChildren(doc.body);
     } else {
-        /* Otherwise it should be plain(er) text, parse "all" links
-           (and reserved XML characters)
-        */
-        // TODO replace with something that doesn't use innerHTML */
-        el.innerHTML = d
-            .replaceAll(/</g, '&lt;')
-            .replaceAll(/>/g, '&gt;')
-            .replaceAll(/&/g, '&amp;')
-            .replaceAll(/'/g, '&apos;')
-            .replaceAll(/"/g, '&quot;')
-            .replaceAll(/https?:\/\/\S+/g, '<a href="$&">$&</a>')
+        /* Otherwise it should be plain(er) text, parse "all" links */
+        let rx = /https?:\/\/\S+/g
+        let idx = 0;
+        let children = []
+        for (let match of d.matchAll(rx)) {
+            let anch = document.createElement('a')
+            anch.href = match[0]
+            anch.textContent = match[0]
+
+            children.push(d.substring(idx, match.index))
+            children.push(anch)
+
+            idx = match.index + match[0].length
+        }
+        children.push(d.substring(idx))
+        el.replaceChildren(...children);
     }
 })
 
-- 
cgit v1.2.3