fix: refuse to render non-string Markdown field values (via #5295)

swagger-api · Apr 10, 2019 · 1dd87ce · 1dd87ce
1 parent f50bbec
commit 1dd87ce
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/src/core/components/providers/markdown.jsx b/src/core/components/providers/markdown.jsx
@@ -19,6 +19,10 @@ DomPurify.addHook("beforeSanitizeElements", function (current, ) {
 const isPlainText = (str) => /^[A-Z\s0-9!?\.]+$/gi.test(str)
 
 function Markdown({ source, className = "" }) {
+    if (typeof source !== "string") {
+      return null
+    }
+
     if(isPlainText(source)) {
       // If the source text is not Markdown,
       // let's save some time and just render it.

diff --git a/src/core/plugins/oas3/wrap-components/markdown.jsx b/src/core/plugins/oas3/wrap-components/markdown.jsx
@@ -10,6 +10,10 @@ parser.block.ruler.enable(["table"])
 parser.set({ linkTarget: "_blank" })
 
 export const Markdown = ({ source, className = "" }) => {
+  if(typeof source !== "string") {
+    return null
+  }
+
   if ( source ) {
     const html = parser.render(source)
     const sanitized = sanitizer(html)