Merge pull request #3679 from traPtitech/security/user_xss

javascipt呼び出しもURLに認識されていたのを修正
traPtitech · Nov 20, 2022 · 0733e5f · 0733e5f
2 parents e0eb627 + 12d727d
commit 0733e5f
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/src/lib/markdown/markdown.ts b/src/lib/markdown/markdown.ts
@@ -37,12 +37,12 @@ const storeProvider: Store = {
     return `${embeddingOrigin}${channelIdToLink(id)}`
   },
   generateUserHref(id) {
-    return encodeURIComponent(`javascript:openUserModal(${JSON.stringify(id)})`)
+    return `javascript:openUserModal(${encodeURIComponent(JSON.stringify(id))})`
   },
   generateUserGroupHref(id) {
-    return encodeURIComponent(
-      `javascript:openGroupModal(${JSON.stringify(id)})`
-    )
+    return `javascript:openGroupModal(${encodeURIComponent(
+      JSON.stringify(id)
+    )})`
   }
 }