fix(menu-item): add step to sanitize string

videojs · Jul 16, 2024 · 8114487 · 8114487
1 parent 493b6bd
commit 8114487
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 3 deletions.
diff --git a/src/js/menu/menu-item.js b/src/js/menu/menu-item.js
@@ -4,7 +4,7 @@
 import ClickableComponent from '../clickable-component.js';
 import Component from '../component.js';
 import {createEl} from '../utils/dom.js';
-import { containsHexCode } from '../utils/str.js';
+import { containsHexCode, sanitizeString } from '../utils/str.js';
 
 /** @import Player from '../player' */
 
@@ -75,9 +75,11 @@ class MenuItem extends ClickableComponent {
       textContent: this.localize(this.options_.label)
     });
 
-    if (containsHexCode(menuItemEl.textContent)) {
+    const sanitizedString = sanitizeString(menuItemEl.textContent);
+
+    if (containsHexCode(sanitizedString)) {
       // Replacement that allows innerHTML to be render properly.
-      menuItemEl.innerHTML = menuItemEl.textContent;
+      menuItemEl.innerHTML = sanitizedString;
     }
 
     // If using SVG icons, the element with vjs-icon-placeholder will be added separately.

diff --git a/src/js/utils/str.js b/src/js/utils/str.js
@@ -64,3 +64,8 @@ export const titleCaseEquals = function(str1, str2) {
 export const containsHexCode = (string) => {
   return /[a-zA-Z\040]*(&#x[0-9a-fA-F]{2,4};)[a-zA-Z\040]*/.test(string);
 };
+
+export const sanitizeString = (string) => {
+  string = string.replace(/[^a-z0-9 áéíóúñü\&#;_]/gim, '');
+  return string.trim();
+};