@defra/forms-model 3.0.396 → 3.0.397

package/dist/module/utils/markdown.js

@@ -9,13 +9,14 @@ export const marked = new Marked({
 });
 
 /**
- * Convert markdown to HTML
+ * Convert markdown to HTML, escaping any HTML tags first
  */
 export function markdownToHtml(markdown) {
   if (markdown === undefined || markdown === null) {
     return '';
   }
-  return marked.parse(markdown, {
+  const escaped = markdown.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;');
+  return marked.parse(escaped, {
     async: false
   });
 }

package/dist/module/utils/markdown.js.map

@@ -1 +1 @@
-{"version":3,"file":"markdown.js","names":["Marked","marked","breaks","gfm","markdownToHtml","markdown","undefined","parse","async"],"sources":["../../../src/utils/markdown.ts"],"sourcesContent":["import { Marked } from 'marked'\n\n/**\n * Marked instance (avoids global option/extension scope)\n */\nexport const marked = new Marked({\n  breaks: true,\n  gfm: true\n})\n\n/**\n * Convert markdown to HTML\n */\nexport function markdownToHtml(markdown?: string | null) {\n  if (markdown === undefined || markdown === null) {\n    return ''\n  }\n\n  return marked.parse(markdown, { async: false })\n}\n"],"mappings":"AAAA,SAASA,MAAM,QAAQ,QAAQ;;AAE/B;AACA;AACA;AACA,OAAO,MAAMC,MAAM,GAAG,IAAID,MAAM,CAAC;EAC/BE,MAAM,EAAE,IAAI;EACZC,GAAG,EAAE;AACP,CAAC,CAAC;;AAEF;AACA;AACA;AACA,OAAO,SAASC,cAAcA,CAACC,QAAwB,EAAE;EACvD,IAAIA,QAAQ,KAAKC,SAAS,IAAID,QAAQ,KAAK,IAAI,EAAE;IAC/C,OAAO,EAAE;EACX;EAEA,OAAOJ,MAAM,CAACM,KAAK,CAACF,QAAQ,EAAE;IAAEG,KAAK,EAAE;EAAM,CAAC,CAAC;AACjD","ignoreList":[]}
+{"version":3,"file":"markdown.js","names":["Marked","marked","breaks","gfm","markdownToHtml","markdown","undefined","escaped","replace","parse","async"],"sources":["../../../src/utils/markdown.ts"],"sourcesContent":["import { Marked } from 'marked'\n\n/**\n * Marked instance (avoids global option/extension scope)\n */\nexport const marked = new Marked({\n  breaks: true,\n  gfm: true\n})\n\n/**\n * Convert markdown to HTML, escaping any HTML tags first\n */\nexport function markdownToHtml(markdown?: string | null) {\n  if (markdown === undefined || markdown === null) {\n    return ''\n  }\n\n  const escaped = markdown\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&#39;')\n\n  return marked.parse(escaped, { async: false })\n}\n"],"mappings":"AAAA,SAASA,MAAM,QAAQ,QAAQ;;AAE/B;AACA;AACA;AACA,OAAO,MAAMC,MAAM,GAAG,IAAID,MAAM,CAAC;EAC/BE,MAAM,EAAE,IAAI;EACZC,GAAG,EAAE;AACP,CAAC,CAAC;;AAEF;AACA;AACA;AACA,OAAO,SAASC,cAAcA,CAACC,QAAwB,EAAE;EACvD,IAAIA,QAAQ,KAAKC,SAAS,IAAID,QAAQ,KAAK,IAAI,EAAE;IAC/C,OAAO,EAAE;EACX;EAEA,MAAME,OAAO,GAAGF,QAAQ,CACrBG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CACtBA,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CACrBA,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CACrBA,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CACvBA,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;EAEzB,OAAOP,MAAM,CAACQ,KAAK,CAACF,OAAO,EAAE;IAAEG,KAAK,EAAE;EAAM,CAAC,CAAC;AAChD","ignoreList":[]}

package/dist/types/utils/markdown.d.ts

@@ -4,7 +4,7 @@ import { Marked } from 'marked';
  */
 export declare const marked: Marked;
 /**
- * Convert markdown to HTML
+ * Convert markdown to HTML, escaping any HTML tags first
  */
 export declare function markdownToHtml(markdown?: string | null): string;
 //# sourceMappingURL=markdown.d.ts.map

package/dist/types/utils/markdown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../../src/utils/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;GAEG;AACH,eAAO,MAAM,MAAM,QAGjB,CAAA;AAEF;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,UAMtD"}
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../../src/utils/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;GAEG;AACH,eAAO,MAAM,MAAM,QAGjB,CAAA;AAEF;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,UAatD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@defra/forms-model",
-  "version": "3.0.396",
+  "version": "3.0.397",
   "description": "A hapi plugin providing the model for Defra forms",
   "homepage": "https://github.com/DEFRA/forms-designer/tree/main/model#readme",
   "repository": {

package/src/utils/markdown.ts

@@ -9,12 +9,19 @@ export const marked = new Marked({
 })
 
 /**
- * Convert markdown to HTML
+ * Convert markdown to HTML, escaping any HTML tags first
  */
 export function markdownToHtml(markdown?: string | null) {
   if (markdown === undefined || markdown === null) {
     return ''
   }
 
-  return marked.parse(markdown, { async: false })
+  const escaped = markdown
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;')
+
+  return marked.parse(escaped, { async: false })
 }