From d6637dc4848b3fa13187bc45d91c13e5116b8211 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jarda=20Kot=C4=9B=C5=A1ovec?= <jarda.kotesovec@gmail.com>
Date: Tue, 6 Feb 2024 14:18:39 +0100
Subject: [PATCH] pkp/pkp-lib#9421 replace v-html with v-strip-unsave-html

---
 .gitignore                                      |  1 +
 package-lock.json                               | 11 +++++++++++
 package.json                                    |  1 +
 plugins/importexport/native/templates/index.tpl |  2 +-
 plugins/importexport/pubmed/templates/index.tpl |  2 +-
 plugins/pubIds/urn/js/FieldTextUrn.js           |  2 +-
 6 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 9b6d777a77a..564dcb3a832 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,7 @@ temp
 .project
 .buildpath
 .settings
+.vscode
 .DS_Store
 .php_cs.cache
 .php-cs-fixer.cache
diff --git a/package-lock.json b/package-lock.json
index 3fb3f2894e8..bb0f1b3040c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12,6 +12,7 @@
         "chart.js": "^2.9.4",
         "clone-deep": "^4.0.1",
         "debounce": "^1.2.0",
+        "dompurify": "^3.0.8",
         "element-resize-event": "^3.0.3",
         "moment": "^2.29.2",
         "tinymce": "^5.10.0",
@@ -5418,6 +5419,11 @@
         "url": "https://github.com/fb55/domhandler?sponsor=1"
       }
     },
+    "node_modules/dompurify": {
+      "version": "3.0.8",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.0.8.tgz",
+      "integrity": "sha512-b7uwreMYL2eZhrSCRC4ahLTeZcPZxSmYfmcQGXGkXiZSNW1X85v+SDM5KsWcpivIiUBH47Ji7NtyUdpLeF5JZQ=="
+    },
     "node_modules/domutils": {
       "version": "2.8.0",
       "resolved": "https://registry.npmjs.org/domutils/-/domutils-2.8.0.tgz",
@@ -17406,6 +17412,11 @@
         "domelementtype": "^2.2.0"
       }
     },
+    "dompurify": {
+      "version": "3.0.8",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.0.8.tgz",
+      "integrity": "sha512-b7uwreMYL2eZhrSCRC4ahLTeZcPZxSmYfmcQGXGkXiZSNW1X85v+SDM5KsWcpivIiUBH47Ji7NtyUdpLeF5JZQ=="
+    },
     "domutils": {
       "version": "2.8.0",
       "resolved": "https://registry.npmjs.org/domutils/-/domutils-2.8.0.tgz",
diff --git a/package.json b/package.json
index a26e709af10..5b13eda086c 100644
--- a/package.json
+++ b/package.json
@@ -15,6 +15,7 @@
     "chart.js": "^2.9.4",
     "clone-deep": "^4.0.1",
     "debounce": "^1.2.0",
+    "dompurify": "^3.0.8",
     "element-resize-event": "^3.0.3",
     "moment": "^2.29.2",
     "tinymce": "^5.10.0",
diff --git a/plugins/importexport/native/templates/index.tpl b/plugins/importexport/native/templates/index.tpl
index 8a38624f169..d99456bec5d 100644
--- a/plugins/importexport/native/templates/index.tpl
+++ b/plugins/importexport/native/templates/index.tpl
@@ -85,7 +85,7 @@
 								/>
 								<span
 									class="listPanel__itemSubTitle"
-									v-html="localize(
+									v-strip-unsafe-html="localize(
 										item.publications.find(p => p.id == item.currentPublicationId).fullTitle,
 										item.publications.find(p => p.id == item.currentPublicationId).locale
 									)"
diff --git a/plugins/importexport/pubmed/templates/index.tpl b/plugins/importexport/pubmed/templates/index.tpl
index 84b4500a019..7ed9e1ce284 100644
--- a/plugins/importexport/pubmed/templates/index.tpl
+++ b/plugins/importexport/pubmed/templates/index.tpl
@@ -52,7 +52,7 @@
 									/>
 									<span 
 										class="listPanel__itemSubTitle" 
-										v-html="localize(
+										v-strip-unsafe-html="localize(
 											item.publications.find(p => p.id == item.currentPublicationId).fullTitle,
 											item.publications.find(p => p.id == item.currentPublicationId).locale
 										)"
diff --git a/plugins/pubIds/urn/js/FieldTextUrn.js b/plugins/pubIds/urn/js/FieldTextUrn.js
index f7625f4cfdb..d9ac6f9e1f7 100644
--- a/plugins/pubIds/urn/js/FieldTextUrn.js
+++ b/plugins/pubIds/urn/js/FieldTextUrn.js
@@ -22,7 +22,7 @@ var template = pkp.Vue.compile('<div class="pkpFormField pkpFormField--text pkpF
 '			<div' +
 '				v-if="isPrimaryLocale && description"' +
 '				class="pkpFormField__description"' +
-'				v-html="description"' +
+'				v-strip-unsafe-html="description"' +
 '				:id="describedByDescriptionId"' +
 '			/>' +
 '			<div class="pkpFormField__control" :class="controlClasses">' +