SECURITY: Render TOC items as plain text (#44)

about.json

@@ -3,6 +3,7 @@
   "component": true,
   "about_url": "https://meta.discourse.org/t/discotoc-automatic-table-of-contents/111143",
   "license_url": "https://github.com/discourse/DiscoTOC/blob/main/LICENSE",
+  "theme_version": "2.1.0",
   "assets": {
     "icons-sprite": "/assets/sprite.svg"
   }

javascripts/discourse/initializers/disco-toc-main.js

@@ -286,9 +286,9 @@ export default {
     li.classList.add("d-toc-item");
     li.classList.add(`d-toc-${clonedNode.tagName.toLowerCase()}`);
 
-    li.innerHTML = `<a href="#" data-d-toc="${clonedNode.getAttribute("id")}">${
+    const id = clonedNode.getAttribute("id");
-      clonedNode.textContent
+    li.innerHTML = `<a href="#" data-d-toc="${id}"></a>`;
-    }</a>`;
+    li.querySelector("a").innerText = clonedNode.textContent.trim();
 
     clonedNode.remove();
     return li;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "DiscoTOC",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "repository": "https://github.com/discourse/DiscoTOC",
   "author": "Discourse",
   "license": "MIT",

test/acceptance/toc-test.js

@@ -122,3 +122,31 @@ acceptance("DiscoTOC - with categories", function (needs) {
     assert.ok(exists(".d-toc-wrapper #d-toc"));
   });
 });
+
+acceptance("DiscoTOC - non-text headings", function (needs) {
+  needs.pretender((server, helper) => {
+    const topicResponse = cloneJSON(topicFixtures["/t/280/1.json"]);
+    topicResponse.post_stream.posts[0].cooked = `
+      <h3 id="toc-h3-span" data-d-toc="toc-h3-span" class="d-toc-post-heading">
+        <a name="span-4" class="anchor" href="#span-4"></a>&lt;span style="color: red"&gt;what about this&lt;/span&gt;</h3>
+      </h3>
+      <p>test</p>
+      ${TOC_MARKUP}
+    `;
+
+    server.get("/t/280.json", () => helper.response(topicResponse));
+    server.get("/t/280/:post_number.json", () =>
+      helper.response(topicResponse)
+    );
+  });
+
+  test("renders the TOC items as plain text", async function (assert) {
+    await visit("/t/internationalization-localization/280");
+
+    const item = query(`#d-toc [data-d-toc="toc-h3-span"]`);
+    assert.strictEqual(
+      item.innerHTML.trim(),
+      `&lt;span style="color: red"&gt;what about this&lt;/span&gt;`
+    );
+  });
+});