Skip to content

[dtq-dev-9-base][v7→v9 adapted] Fix 1083 R68: sanitize RefBox citation HTML (port of #1662) - #1679

Open
Kasinhou wants to merge 1 commit into
dtq-dev-9-basefrom
v9base/port-1662
Open

Kasinhou wants to merge 1 commit into
dtq-dev-9-basefrom
v9base/port-1662

Conversation

@Kasinhou

Copy link
Copy Markdown

⚠️ PORT z v7 — CHERRY-PICK NEBOL ČISTÝ, MUSEL BYŤ UPRAVENÝ PRE v9

Tento fix pochádza z dtq-dev (v7). Cherry-pick do dtq-dev-9-base sa NEDAL aplikovať úplne čisto a bolo ho treba manuálne prispôsobiť v9. Prosím o dôkladný review.

Čo bolo treba upraviť: v9 už importuje BehaviorSubject (v7 duplicitný import zahodený) a po zmene tela ostali nepoužité importy DomSanitizer/SafeHtml — odstránené. Produkčná logika (posielať surový string, spoliehať sa na Angular [innerHTML] sanitizáciu) aplikovaná. ⚠️ spec NEBOL portnutý.


Port of #1662 z dtq-dev do dtq-dev-9-base. Part of UFAL/Propagate PRs to v9: dataquest-dev/dspace-customers#1107

🤖 Generated with Claude Code

)

The citation text came from the server and was rendered with
bypassSecurityTrustHtml, so markup in item metadata could run scripts.
It now goes through Angular's sanitizer, which keeps the <i> and <a>
formatting, strips scripts and event handlers, and makes javascript:
links inert.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit a5298dd)
@Kasinhou Kasinhou self-assigned this Oct 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants