fix(ui): remove html from summary before display

Netflix · Dec 19, 2024 · e5ebdb5 · e5ebdb5
1 parent aacdbbb
commit e5ebdb5
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/dispatch/static/dispatch/src/incident/TimelineReportTab.vue b/src/dispatch/static/dispatch/src/incident/TimelineReportTab.vue
@@ -75,6 +75,7 @@
 import { mapFields } from "vuex-map-fields"
 import { formatToUTC, formatToTimeZones } from "@/filters"
 import { mapActions } from "vuex"
+import DOMPurify from "dompurify"
 
 export default {
   name: "IncidentTimelineReportTab",
@@ -93,7 +94,7 @@ export default {
     },
 
     incidentSummary() {
-      return this.summary
+      return DOMPurify.sanitize(this.summary, { ALLOWED_TAGS: [] })
         .split("\n")
         .map((part) => `<p >${part}</p>`)
         .join("")