vynte-infra/calendar
2
0
Fork 0
Code Issues Pull Requests Actions 2.0k Packages Projects Releases Wiki Activity

fix: sanitize event type text in Gmail dropdown (#27533)

Browse Source 
- Add shared escapeHtml utility function
 - Apply text sanitization to title/description in content.ts
 - Refactor linkedin.ts to use shared utility
This commit is contained in:
Pedro Castro
2026-02-04 02:10:04 +05:30
committed by GitHub
parent efcbc3a07b
commit 5dfa1dfd74
3 changed files with 16 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
companion/extension/entrypoints/content.ts
+5 -4
View File
@@ -1,6 +1,7 @@
/// <reference types="chrome" />
import { initGoogleCalendarIntegration } from "../lib/google-calendar";
import { initLinkedInIntegration } from "../lib/linkedin";
import { escapeHtml } from "../lib/utils";
/**
* Development-only logging utility for content scripts.
@@ -964,7 +965,7 @@ export default defineContentScript({
contentWrapper.innerHTML = `
<div style="display: flex; align-items: center; margin-bottom: 6px; overflow: hidden;">
<span style="color: #3c4043; font-weight: 500; font-size: 14px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; display: block;">${title}</span>
<span style="color: #3c4043; font-weight: 500; font-size: 14px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; display: block;">${escapeHtml(title)}</span>
</div>
<div style="display: flex; align-items: center; gap: 8px; overflow: hidden;">
<span style="
@@ -983,7 +984,7 @@ export default defineContentScript({
</span>
${
description
? `<span style="color: #5f6368; font-size: 12px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; flex: 1; min-width: 0;">${description}</span>`
? `<span style="color: #5f6368; font-size: 12px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; flex: 1; min-width: 0;">${escapeHtml(description)}</span>`
: ""
}
</div>
@@ -1714,7 +1715,7 @@ export default defineContentScript({
contentWrapper.innerHTML = `
<div style="display: flex; align-items: center; margin-bottom: 6px; overflow: hidden;">
<span style="color: #3c4043; font-weight: 500; font-size: 14px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; display: block;">${title}</span>
<span style="color: #3c4043; font-weight: 500; font-size: 14px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; display: block;">${escapeHtml(title)}</span>
</div>
<div style="display: flex; align-items: center; gap: 8px; overflow: hidden;">
<span style="
@@ -1733,7 +1734,7 @@ export default defineContentScript({
</span>
${
description
? `<span style="color: #5f6368; font-size: 12px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; flex: 1; min-width: 0;">${description}</span>`
? `<span style="color: #5f6368; font-size: 12px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; flex: 1; min-width: 0;">${escapeHtml(description)}</span>`
: ""
}
</div>
companion/extension/lib/linkedin.ts
+1 -9
View File
@@ -1,4 +1,5 @@
/// <reference types="chrome" />
import { escapeHtml } from "./utils";
// LinkedIn integration: inject a Cal.com scheduling button in LinkedIn messaging
@@ -951,15 +952,6 @@ export function initLinkedInIntegration() {
}
// ============================================================================
// Utility Functions
// ============================================================================
function escapeHtml(text: string): string {
const div = document.createElement("div");
div.textContent = text;
return div.innerHTML;
}
// ============================================================================
// Initialization
// ============================================================================
companion/extension/lib/utils.ts
+10
View File
@@ -0,0 +1,10 @@
/**
* Escapes HTML special characters to prevent XSS attacks.
* Uses the browser's built-in text encoding via textContent.
*/
export function escapeHtml(text: string): string {
if (typeof text !== "string") return "";
const div = document.createElement("div");
div.textContent = text;
return div.innerHTML;
}