From a5afed93843df96a3c3c42b5181791503347c64a Mon Sep 17 00:00:00 2001 From: "jeremy@jermolene.com" Date: Tue, 20 Dec 2022 17:31:51 +0000 Subject: [PATCH] Fix crash with illegal tag names for element widget Fixes #7122 --- core/modules/widgets/element.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/core/modules/widgets/element.js b/core/modules/widgets/element.js index 1f6fc6c09..716886e5b 100755 --- a/core/modules/widgets/element.js +++ b/core/modules/widgets/element.js @@ -30,10 +30,14 @@ ElementWidget.prototype.render = function(parent,nextSibling) { this.parentDomNode = parent; this.computeAttributes(); // Neuter blacklisted elements - this.tag = this.parseTreeNode.tag || "span"; + this.tag = this.parseTreeNode.tag; if($tw.config.htmlUnsafeElements.indexOf(this.tag) !== -1) { this.tag = "safe-" + this.tag; } + // Restrict tag name to digits, letts and dashes + this.tag = this.tag.replace(/[^0-9a-zA-Z\-]/mg,""); + // Default to a span + this.tag = this.tag || "span"; // Adjust headings by the current base level var headingLevel = ["h1","h2","h3","h4","h5","h6"].indexOf(this.tag); if(headingLevel !== -1) {