From 715ef2a837a34a12cfad43fc806f5103f41233aa Mon Sep 17 00:00:00 2001
From: Jeremy Davis <jeremy.davis@sonarsource.com>
Date: Wed, 26 Jun 2019 14:34:26 +0200
Subject: [PATCH] SONAR-12236 Fix SSF-81

---
 .../main/js/components/issue/components/IssueCommentLine.tsx  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/sonar-web/src/main/js/components/issue/components/IssueCommentLine.tsx b/server/sonar-web/src/main/js/components/issue/components/IssueCommentLine.tsx
index 09de825c56a..e58535bff9f 100644
--- a/server/sonar-web/src/main/js/components/issue/components/IssueCommentLine.tsx
+++ b/server/sonar-web/src/main/js/components/issue/components/IssueCommentLine.tsx
@@ -18,6 +18,7 @@
  * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
 import * as React from 'react';
+import { sanitize } from 'dompurify';
 import Avatar from '../../ui/Avatar';
 import Toggler from '../../controls/Toggler';
 import { EditButton, DeleteButton } from '../../ui/buttons';
@@ -89,8 +90,7 @@ export default class IssueCommentLine extends React.PureComponent<Props, State>
         </div>
         <div
           className="issue-comment-text markdown"
-          // Safe: Comes from the backend, after markdown transformation to html
-          dangerouslySetInnerHTML={{ __html: comment.htmlText }}
+          dangerouslySetInnerHTML={{ __html: sanitize(comment.htmlText) }}
         />
         <div className="issue-comment-age">
           <DateFromNow date={comment.createdAt} />
-- 
2.39.5