[FIX] Escaping HTML on paste/drop Text (#471)

Shailesh351 · MartinSchoeler · web-flow · commit 8bc8c252c8cd · 2021-09-14T15:28:28.000-03:00
Co-authored-by: Martin Schoeler &lt;martin.schoeler@rocket.chat&gt;
diff --git a/src/components/Composer/index.js b/src/components/Composer/index.js
@@ -25,6 +25,7 @@ const parse = (plainText) =>
 	[{ plain: plainText }]
 		.map(({ plain, html }) => (plain ? escapeHtml(plain) : html || ''))
 		.join('');
+
 const findLastTextNode = (node) => {
 	if (node.nodeType === Node.TEXT_NODE) {
 		return node;
@@ -97,7 +98,7 @@ export class Composer extends Component {
 			items.filter((item) => item.kind === 'string' && /^text\/plain/.test(item.type))
 				.map((item) => new Promise((resolve) => item.getAsString(resolve))),
 		);
-		texts.forEach((text) => this.pasteText(text));
+		texts.forEach((text) => this.pasteText(parse(text)));
 	}
 
 	handleDrop = (onUpload) => async (event) => {
@@ -120,7 +121,7 @@ export class Composer extends Component {
 			items.filter((item) => item.kind === 'string' && /^text\/plain/.test(item.type))
 				.map((item) => new Promise((resolve) => item.getAsString(resolve))),
 		);
-		texts.forEach((text) => this.pasteText(text));
+		texts.forEach((text) => this.pasteText(parse(text)));
 	}
 
 	handleClick = () => {
