Properly escape HTML when working with content editable elements.

src/content-script-tools/custom-events/workflowy.js

@@ -1,9 +1,11 @@
+import string from 'ac-util/string';
+
 export default {
   url: new RegExp('https://workflowy\.com.*', 'i'),
   // override setvalue
   bind: function (window) {
     this.setValue = (value) => {
-      this.elem.innerHTML = value;
+      this.elem.innerHTML = string.htmlEscape(value);
     };
   }
 };

src/handlers/content-editable.js

@@ -1,4 +1,5 @@
 import BaseHandler from './base';
+import string from 'ac-util/string';
 
 class ContentEditableHandler extends BaseHandler {
   getValue() {
@@ -31,7 +32,7 @@ class ContentEditableHandler extends BaseHandler {
       if (v.trim().length === 0) {
         return '<br>';
       }
-      return '<div>' + v + '</div>';
+      return '<div>' + string.htmlEscape(v) + '</div>';
     }).join('');
     this.elem.innerHTML = htmlValue;
     super.setValue(value);

src/util/string.js

@@ -4,5 +4,17 @@ export default {
       return s;
     }
     return s[0].toUpperCase() + s.slice(1);
+  },
+
+  htmlEscape: function (s) {
+    if (!s) {
+      return s;
+    }
+    return s
+      .replace(/&/g, '&')
+      .replace(/"/g, '"')
+      .replace(/'/g, ''')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;');
   }
 };