fix: xxs attack on listname, have a loading state

drips-network · Oct 4, 2023 · a90028a · a90028a
1 parent 6c8a016
commit a90028a
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/src/lib/components/drip-list-badge/drip-list-badge.svelte b/src/lib/components/drip-list-badge/drip-list-badge.svelte
@@ -4,7 +4,7 @@
   import formatAddress from '$lib/utils/format-address';
 
   export let listId: string;
-  export let listName: string | undefined = undefined;
+  export let listName: string | '##loading##' | undefined = undefined;
   export let owner: string | undefined = undefined;
 
   export let isLinked = true;
@@ -41,7 +41,8 @@
     <div class="name typo-text text-foreground flex-1 min-w-0 truncate">
       <span
         >{#if username}<span class="text-foreground-level-5">{username}/</span
-          >{/if}{@html listName}</span
+          >{/if}{#if listName === '##loading##'}<span class="animate-pulse">...</span
+          >{:else}{listName}{/if}</span
       >
     </div>
   {/if}

diff --git a/src/lib/components/table/cells/user-badge.cell.svelte b/src/lib/components/table/cells/user-badge.cell.svelte
@@ -46,7 +46,7 @@
 {:else}
   <!-- TODO: Donʼt presume any NFT account is a Drip List. -->
   <DripListBadge
-    listName={dripList ? dripList.name : '<span class="animate-pulse">...</span>'}
+    listName={dripList ? dripList.name : '##loading##'}
     listId={user.accountId}
     avatarSize="small"
     isLinked={false}