From dde6e46fb959a7da92659588e3a2890cad85e14a Mon Sep 17 00:00:00 2001
From: brunosimon <simon.bruno.77@gmail.com>
Date: Mon, 31 Jul 2017 21:52:22 +0200
Subject: [PATCH] :sparkles: Chat > Add HTML entities

---
 lib/chat.js       | 6 ++++--
 lib/site.js       | 6 +++---
 package-lock.json | 5 +++++
 package.json      | 1 +
 4 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/lib/chat.js b/lib/chat.js
index 16bb5e6..882ae8e 100644
--- a/lib/chat.js
+++ b/lib/chat.js
@@ -2,6 +2,7 @@
 
 const ids = require('./ids.js')
 const robotNames = require('./robot-names.json')
+const HTMLEntities = require('html-entities')
 
 class Chat
 {
@@ -12,6 +13,7 @@ class Chat
         this.users = {}
         this.messages = []
         this.availableRobotNames = this.shuffle(robotNames.slice())
+        this.htmlEntities = new HTMLEntities.XmlEntities()
 
         this.setSocket()
     }
@@ -52,7 +54,7 @@ class Chat
                 const broadcastMessage = {}
                 broadcastMessage.id = data.id
                 broadcastMessage.time = data.time
-                broadcastMessage.text = data.text
+                broadcastMessage.text = this.htmlEntities.encode(data.text)
                 broadcastMessage.file = data.file
                 broadcastMessage.line = data.line
                 broadcastMessage.user = user
@@ -79,7 +81,7 @@ class Chat
                 }
 
                 // Update name
-                user.name = data.name
+                user.name = this.htmlEntities.encode(data.name)
 
                 // Debug
                 if(this.config.debug >= 1)
diff --git a/lib/site.js b/lib/site.js
index 7dc7239..104f2c1 100644
--- a/lib/site.js
+++ b/lib/site.js
@@ -180,15 +180,15 @@ class Site
 
                         const $author = document.createElement('div')
                         $author.style.color = data.user.color
-                        $author.innerText = data.user.name
+                        $author.innerHTML = data.user.name
                         $message.appendChild($author)
 
                         const $info = document.createElement('div')
-                        $info.innerText = data.file + ':' + data.line
+                        $info.innerHTML = data.file + ':' + data.line
                         $message.appendChild($info)
 
                         const $text = document.createElement('div')
-                        $text.innerText = data.text
+                        $text.innerHTML = data.text
                         $message.appendChild($text)
 
                         $messages.appendChild($message)
diff --git a/package-lock.json b/package-lock.json
index 4ffdf0a..5da6eed 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1936,6 +1936,11 @@
         "core-util-is": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz"
       }
     },
+    "html-entities": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/html-entities/-/html-entities-1.2.1.tgz",
+      "integrity": "sha1-DfKTUfByEWNRXfueVUPl9u7VFi8="
+    },
     "http-errors": {
       "version": "https://registry.npmjs.org/http-errors/-/http-errors-1.5.1.tgz",
       "integrity": "sha1-eIwNLB3iyBuebowBhDtrl+uSB1A=",
diff --git a/package.json b/package.json
index 8f8bc1c..2780c5e 100644
--- a/package.json
+++ b/package.json
@@ -27,6 +27,7 @@
     "express": "^4.13.4",
     "glob": "^7.1.2",
     "helmet": "^2.1.0",
+    "html-entities": "^1.2.1",
     "ip": "^1.1.3",
     "mime": "^1.3.4",
     "minimatch": "^3.0.3",