dm-4881 dom text reinterpret / xss codeql warning 3 (#1133)

department-of-veterans-affairs · Dec 6, 2024 · 6df982d · 6df982d
1 parent 0b9d84b
commit 6df982d
Showing 1 changed file with 5 additions and 8 deletions.
diff --git a/app/assets/javascripts/practice_page.es6 b/app/assets/javascripts/practice_page.es6
@@ -56,14 +56,11 @@
         const moreText = 'See more';
         const lessText = 'See less';
         let t = $(element).text();
-        let firstHalf = `${t.slice(
-          0,
-          showChar
-        )}<span>${ellipsesText} </span><button type="button" class="dm-button--unstyled-primary more-link">${moreText}</button>`;
-        let secondHalf = `<span style="display:none;">${t.slice(
-          showChar,
-          t.length
-        )} <button type="button" class="dm-button--unstyled-primary less-link">${lessText}</button></span>`;
+        let firstHalf = `${_.escape(t.slice(0, showChar))}<span>${ellipsesText} </span>
+            <button type="button" class="dm-button--unstyled-primary more-link">${moreText}</button>`;
+        let secondHalf = `<span style="display:none;">${_.escape(t.slice(showChar, t.length))}
+            <button type="button" class="dm-button--unstyled-primary less-link">${lessText}</button></span>`;
+
         if (t.length < showChar) return;
 
         $(element).html(firstHalf + secondHalf);