From 5783af341da0db906d050e88c0bb567878675383 Mon Sep 17 00:00:00 2001
From: milanmajchrak <90026355+milanmajchrak@users.noreply.github.com>
Date: Tue, 27 Oct 2026 13:39:19 +0100
Subject: [PATCH] UFAL/Fix dspace-customers 1083 R68: sanitize RefBox citation
 HTML (#1662)

The citation text came from the server and was rendered with
bypassSecurityTrustHtml, so markup in item metadata could run scripts.
It now goes through Angular's sanitizer, which keeps the <i> and <a>
formatting, strips scripts and event handlers, and makes javascript:
links inert.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit a5298dd8ea60f9d05a42d7275a769f8613cbeb80)
---
 .../clarin-ref-citation.component.ts                | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/src/app/item-page/clarin-ref-citation/clarin-ref-citation.component.ts b/src/app/item-page/clarin-ref-citation/clarin-ref-citation.component.ts
index 6bf5647acb6..c8fcada85eb 100644
--- a/src/app/item-page/clarin-ref-citation/clarin-ref-citation.component.ts
+++ b/src/app/item-page/clarin-ref-citation/clarin-ref-citation.component.ts
@@ -6,10 +6,6 @@ import {
   OnInit,
   ViewChild,
 } from '@angular/core';
-import {
-  DomSanitizer,
-  SafeHtml,
-} from '@angular/platform-browser';
 import {
   NgbModal,
   NgbTooltip,
@@ -64,9 +60,9 @@ export class ClarinRefCitationComponent implements OnInit {
 
   /**
    * The content of the reference box, which will be displayed in the tooltip.
-   * This content is fetched from the RefBox Controller.
+   * This content is fetched from the RefBox Controller and sanitized by Angular when rendered.
    */
-  refboxContent: BehaviorSubject<SafeHtml> = new BehaviorSubject<SafeHtml>(null);
+  refboxContent: BehaviorSubject<string> = new BehaviorSubject<string>(null);
 
   /**
    * The raw content of the reference box, which is fetched from the RefBox Controller.
@@ -84,8 +80,7 @@ export class ClarinRefCitationComponent implements OnInit {
               private modalService: NgbModal,
               private requestService: RequestService,
               protected rdbService: RemoteDataBuildService,
-              protected halService: HALEndpointService,
-              private sanitizer: DomSanitizer) {
+              protected halService: HALEndpointService) {
     // Configure the tooltip to show on click - `Copied` message
     config.triggers = 'click';
   }
@@ -94,7 +89,7 @@ export class ClarinRefCitationComponent implements OnInit {
     void this.fetchRefBoxContent()
       .then((content) => {
         this.refboxCopyContent = content; // Store raw HTML
-        this.refboxContent.next(this.sanitizer.bypassSecurityTrustHtml(content));
+        this.refboxContent.next(content);
       }).catch((error) => {
         console.error('Failed to fetch refbox content:', error);
         this.refboxCopyContent = this.EMPTY_CONTENT;