Fix XSS attack (again)

Now escaping only for slashes, since HTML is apparently case insensitive and using a script closing tag that wasn't entirely lowercase bypassed the earlier fix.
2023-03-09 20:05:57 +01:00 · 2023-03-09 20:05:57 +01:00 · 181ebb3a63
commit 181ebb3a63
parent c83a775ac2
1 changed files with 1 additions and 1 deletions
--- a/src/pasta.rs
+++ b/src/pasta.rs
@ -155,7 +155,7 @@ impl Pasta {
        self.content
            .replace('`', "\\`")
            .replace('$', "\\$")
-            .replace("</script", "<\\/script")
+            .replace('/', "\\/")
    }
 }