fix: json in html not unescaped

PhotonQuantum · May 29, 2023 · f041378 · f041378
1 parent 5895b5f
commit f041378
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 1 deletion.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/core/Cargo.toml b/core/Cargo.toml
@@ -15,6 +15,7 @@ futures = "0.3"
 futures-retry-policies = "0.2"
 handlebars = "4.2"
 html2text = "0.6"
+htmlescape = "0.3"
 leaky-bucket = "1.0"
 lol_html = "1.0"
 mac_address = "1.1"

diff --git a/core/src/preloaded_store.rs b/core/src/preloaded_store.rs
@@ -48,7 +48,10 @@ impl PreloadedStore {
         )
         .write(body.as_bytes());
 
-        Ok(serde_json::from_str(&preloaded.expect("#data-preloaded"))?)
+        let unescaped =
+            htmlescape::decode_html(&preloaded.expect("#data-preloaded")).expect("unescaped");
+
+        Ok(serde_json::from_str(&unescaped)?)
     }
     pub fn custom_emoji(&self, name: &str) -> Option<&str> {
         self.custom_emoji.get(name).map(String::as_str)