Compare commits

...

2 Commits

Author SHA1 Message Date
Oleksii Holub 5632d6c386 HTML-encode markdown content when formatting is disabled (#1545) 2026-06-04 13:09:03 +03:00
Oleksii Holub f4d1e630f7 Implement missing HTML encoding for several attribute injections (#1544) 2026-06-04 12:38:09 +03:00
3 changed files with 32 additions and 34 deletions
@@ -162,7 +162,7 @@ internal partial class HtmlMarkdownVisitor(
) )
{ {
var highlightClass = !string.IsNullOrWhiteSpace(multiLineCodeBlock.Language) var highlightClass = !string.IsNullOrWhiteSpace(multiLineCodeBlock.Language)
? $"language-{multiLineCodeBlock.Language}" ? $"language-{HtmlEncode(multiLineCodeBlock.Language)}"
: "nohighlight"; : "nohighlight";
buffer.Append( buffer.Append(
@@ -217,9 +217,11 @@ internal partial class HtmlMarkdownVisitor(
<img <img
loading="lazy" loading="lazy"
class="chatlog__emoji {jumboClass}" class="chatlog__emoji {jumboClass}"
alt="{emoji.Name}" alt="{HtmlEncode(emoji.Name)}"
title="{emoji.Code}" title="{HtmlEncode(emoji.Code)}"
src="{await context.ResolveAssetUrlAsync(emoji.ImageUrl, cancellationToken)}"> src="{HtmlEncode(
await context.ResolveAssetUrlAsync(emoji.ImageUrl, cancellationToken)
)}">
""" """
); );
} }
@@ -293,14 +295,8 @@ internal partial class HtmlMarkdownVisitor(
var name = role?.Name ?? "deleted-role"; var name = role?.Name ?? "deleted-role";
var color = role?.Color; var color = role?.Color;
var style = color is not null var style = color is { } c
? $""" ? $"color: rgb({c.R}, {c.G}, {c.B}); background-color: rgba({c.R}, {c.G}, {c.B}, 0.1);"
color: rgb({color.Value.R}, {color.Value.G}, {color
.Value
.B}); background-color: rgba({color.Value.R}, {color.Value.G}, {color
.Value
.B}, 0.1);
"""
: null; : null;
buffer.Append( buffer.Append(
@@ -2,6 +2,7 @@
@using System.Collections.Generic @using System.Collections.Generic
@using System.Linq @using System.Linq
@using System.Threading.Tasks @using System.Threading.Tasks
@using RazorBlade
@using DiscordChatExporter.Core.Discord.Data @using DiscordChatExporter.Core.Discord.Data
@using DiscordChatExporter.Core.Discord.Data.Embeds @using DiscordChatExporter.Core.Discord.Data.Embeds
@using DiscordChatExporter.Core.Markdown.Parsing @using DiscordChatExporter.Core.Markdown.Parsing
@@ -23,15 +24,15 @@
string FormatDate(DateTimeOffset instant, string format = "g") => string FormatDate(DateTimeOffset instant, string format = "g") =>
Context.FormatDate(instant, format); Context.FormatDate(instant, format);
async ValueTask<string> FormatMarkdownAsync(string markdown) => async ValueTask<IEncodedContent> FormatMarkdownAsync(string markdown) =>
Context.Request.ShouldFormatMarkdown Context.Request.ShouldFormatMarkdown
? await HtmlMarkdownVisitor.FormatAsync(Context, markdown, true, CancellationToken) ? Html.Raw(await HtmlMarkdownVisitor.FormatAsync(Context, markdown, true, CancellationToken))
: markdown; : Html.Raw(Html.Encode(markdown));
async ValueTask<string> FormatEmbedMarkdownAsync(string markdown) => async ValueTask<IEncodedContent> FormatEmbedMarkdownAsync(string markdown) =>
Context.Request.ShouldFormatMarkdown Context.Request.ShouldFormatMarkdown
? await HtmlMarkdownVisitor.FormatAsync(Context, markdown, false, CancellationToken) ? Html.Raw(await HtmlMarkdownVisitor.FormatAsync(Context, markdown, false, CancellationToken))
: markdown; : Html.Raw(Html.Encode(markdown));
} }
<div class="chatlog__message-group"> <div class="chatlog__message-group">
@@ -179,7 +180,7 @@
<span class="chatlog__reply-link" onclick="scrollToMessage(event, '@message.ReferencedMessage.Id')"> <span class="chatlog__reply-link" onclick="scrollToMessage(event, '@message.ReferencedMessage.Id')">
@if (!string.IsNullOrWhiteSpace(message.ReferencedMessage.Content) && !message.ReferencedMessage.IsContentHidden()) @if (!string.IsNullOrWhiteSpace(message.ReferencedMessage.Content) && !message.ReferencedMessage.IsContentHidden())
{ {
<!--wmm:ignore-->@Html.Raw(await FormatEmbedMarkdownAsync(message.ReferencedMessage.Content))<!--/wmm:ignore--> <!--wmm:ignore-->@(await FormatEmbedMarkdownAsync(message.ReferencedMessage.Content))<!--/wmm:ignore-->
} }
else if (message.ReferencedMessage.Attachments.Any() || message.ReferencedMessage.Embeds.Any()) else if (message.ReferencedMessage.Attachments.Any() || message.ReferencedMessage.Embeds.Any())
{ {
@@ -252,7 +253,7 @@
@* Text *@ @* Text *@
@if (!string.IsNullOrWhiteSpace(message.Content) && !message.IsContentHidden()) @if (!string.IsNullOrWhiteSpace(message.Content) && !message.IsContentHidden())
{ {
<span class="chatlog__markdown-preserve"><!--wmm:ignore-->@Html.Raw(await FormatMarkdownAsync(message.Content))<!--/wmm:ignore--></span> <span class="chatlog__markdown-preserve"><!--wmm:ignore-->@(await FormatMarkdownAsync(message.Content))<!--/wmm:ignore--></span>
} }
@* Edited timestamp *@ @* Edited timestamp *@
@@ -278,7 +279,7 @@
@if (!string.IsNullOrWhiteSpace(message.ForwardedMessage.Content)) @if (!string.IsNullOrWhiteSpace(message.ForwardedMessage.Content))
{ {
<div class="chatlog__forwarded-content chatlog__markdown"> <div class="chatlog__forwarded-content chatlog__markdown">
<span class="chatlog__markdown-preserve"><!--wmm:ignore-->@Html.Raw(await FormatMarkdownAsync(message.ForwardedMessage.Content))<!--/wmm:ignore--></span> <span class="chatlog__markdown-preserve"><!--wmm:ignore-->@(await FormatMarkdownAsync(message.ForwardedMessage.Content))<!--/wmm:ignore--></span>
</div> </div>
} }
@@ -504,12 +505,12 @@
@if (!string.IsNullOrWhiteSpace(embed.Url)) @if (!string.IsNullOrWhiteSpace(embed.Url))
{ {
<a class="chatlog__embed-title-link" href="@embed.Url"> <a class="chatlog__embed-title-link" href="@embed.Url">
<div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@Html.Raw(await FormatEmbedMarkdownAsync(embed.Title))<!--/wmm:ignore--></div> <div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@(await FormatEmbedMarkdownAsync(embed.Title))<!--/wmm:ignore--></div>
</a> </a>
} }
else else
{ {
<div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@Html.Raw(await FormatEmbedMarkdownAsync(embed.Title))<!--/wmm:ignore--></div> <div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@(await FormatEmbedMarkdownAsync(embed.Title))<!--/wmm:ignore--></div>
} }
</div> </div>
} }
@@ -543,7 +544,7 @@
</div> </div>
} }
// Generic video embed // Generic video embed
else if (embed.Kind == EmbedKind.Video else if (embed.Kind == EmbedKind.Video
&& !string.IsNullOrWhiteSpace(embed.Url) && !string.IsNullOrWhiteSpace(embed.Url)
// Twitch clips cannot be embedded in local HTML files // Twitch clips cannot be embedded in local HTML files
&& embed.TryGetTwitchClip() is null) && embed.TryGetTwitchClip() is null)
@@ -624,12 +625,12 @@
@if (!string.IsNullOrWhiteSpace(embed.Url)) @if (!string.IsNullOrWhiteSpace(embed.Url))
{ {
<a class="chatlog__embed-title-link" href="@embed.Url"> <a class="chatlog__embed-title-link" href="@embed.Url">
<div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@Html.Raw(await FormatEmbedMarkdownAsync(embed.Title))<!--/wmm:ignore--></div> <div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@(await FormatEmbedMarkdownAsync(embed.Title))<!--/wmm:ignore--></div>
</a> </a>
} }
else else
{ {
<div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@Html.Raw(await FormatEmbedMarkdownAsync(embed.Title))<!--/wmm:ignore--></div> <div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@(await FormatEmbedMarkdownAsync(embed.Title))<!--/wmm:ignore--></div>
} }
</div> </div>
} }
@@ -638,7 +639,7 @@
@if (!string.IsNullOrWhiteSpace(embed.Description)) @if (!string.IsNullOrWhiteSpace(embed.Description))
{ {
<div class="chatlog__embed-description"> <div class="chatlog__embed-description">
<div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@Html.Raw(await FormatEmbedMarkdownAsync(embed.Description))<!--/wmm:ignore--></div> <div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@(await FormatEmbedMarkdownAsync(embed.Description))<!--/wmm:ignore--></div>
</div> </div>
} }
@@ -652,14 +653,14 @@
@if (!string.IsNullOrWhiteSpace(field.Name)) @if (!string.IsNullOrWhiteSpace(field.Name))
{ {
<div class="chatlog__embed-field-name"> <div class="chatlog__embed-field-name">
<div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@Html.Raw(await FormatEmbedMarkdownAsync(field.Name))<!--/wmm:ignore--></div> <div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@(await FormatEmbedMarkdownAsync(field.Name))<!--/wmm:ignore--></div>
</div> </div>
} }
@if (!string.IsNullOrWhiteSpace(field.Value)) @if (!string.IsNullOrWhiteSpace(field.Value))
{ {
<div class="chatlog__embed-field-value"> <div class="chatlog__embed-field-value">
<div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@Html.Raw(await FormatEmbedMarkdownAsync(field.Value))<!--/wmm:ignore--></div> <div class="chatlog__markdown chatlog__markdown-preserve"><!--wmm:ignore-->@(await FormatEmbedMarkdownAsync(field.Value))<!--/wmm:ignore--></div>
</div> </div>
} }
</div> </div>
@@ -1,5 +1,6 @@
@using System @using System
@using System.Threading.Tasks @using System.Threading.Tasks
@using RazorBlade
@inherits RazorBlade.HtmlTemplate @inherits RazorBlade.HtmlTemplate
@@ -24,10 +25,10 @@
string FormatDate(DateTimeOffset instant, string format = "g") => string FormatDate(DateTimeOffset instant, string format = "g") =>
Context.FormatDate(instant, format); Context.FormatDate(instant, format);
async ValueTask<string> FormatMarkdownAsync(string markdown) => async ValueTask<IEncodedContent> FormatMarkdownAsync(string markdown) =>
Context.Request.ShouldFormatMarkdown Context.Request.ShouldFormatMarkdown
? await HtmlMarkdownVisitor.FormatAsync(Context, markdown, true, CancellationToken) ? Html.Raw(await HtmlMarkdownVisitor.FormatAsync(Context, markdown, true, CancellationToken))
: markdown; : Html.Raw(Html.Encode(markdown));
} }
<!DOCTYPE html> <!DOCTYPE html>
@@ -748,7 +749,7 @@
.chatlog__embed-spotify { .chatlog__embed-spotify {
border: 0; border: 0;
} }
.chatlog__embed-twitch { .chatlog__embed-twitch {
border: 0; border: 0;
} }
@@ -1063,7 +1064,7 @@
@if (!string.IsNullOrWhiteSpace(Context.Request.Channel.Topic)) @if (!string.IsNullOrWhiteSpace(Context.Request.Channel.Topic))
{ {
<div class="preamble__entry preamble__entry--small">@Html.Raw(await FormatMarkdownAsync(Context.Request.Channel.Topic))</div> <div class="preamble__entry preamble__entry--small">@(await FormatMarkdownAsync(Context.Request.Channel.Topic))</div>
} }
@if (Context.Request.After is not null || Context.Request.Before is not null) @if (Context.Request.After is not null || Context.Request.Before is not null)