Merge pull request from GHSA-2693-xr3m-jhqr

3 years ago · ff32475f5f
1 changed files with 3 additions and 1 deletions
--- a/app/services/translate_status_service.rb
+++ b/app/services/translate_status_service.rb
@ -75,7 +75,9 @@ class TranslateStatusService < BaseService

      case source
      when :content
-        status_translation.content = unwrap_emoji_shortcodes(translation.text).to_html
+        node = unwrap_emoji_shortcodes(translation.text)
+        Sanitize.node!(node, Sanitize::Config::MASTODON_STRICT)
+        status_translation.content = node.to_html
      when :spoiler_text
        status_translation.spoiler_text = unwrap_emoji_shortcodes(translation.text).content
      when Poll::Option