Search code examples
meteorjavascript-injection

MeteorJS allow injection of anchor tag


I have a basic chat that reads from a database. Each chat message is read from the database by this.

<span>{{formatChat text}}</span>    

text being the message read. And then I use the formatChat registerHelper to detect URLs.

Template.registerHelper('formatChat', function(text) {
  var urlRegex = /https?:\/\/([a-zA-Z0-9\-\.]+)(\.[a-zA-Z0-9]+)((([a-zA-Z0-9\?\=\/])+)?((\#|\?)(.+)?)?)?$/
  var urlRegexMini = /(www(\d{0,3})\.)?([a-zA-Z0-9\-\.]+)(\.(com|net|org|gov|co\.uk|edu|io\b)+)([a-zA-Z0-9\?\=\/]+((([a-zA-Z0-9\?\=\/])+)?((\#|\?)(.+)?)?)?)?$/
  finalString = "";
  //Parse every word individually
  split = text.split(' ');
  for (i = 0; i < split.length; i++) {
    finalString += " ";
    if (urlRegex.test(split[i])) {
      finalString += "<a href='" + split[i] +  "'>" + split[i] + "</a>";
    }
    else if (urlRegexMini.test(split[i])) {
      finalString += "<a href='http://" + split[i] + "'>" + split[i] + "</a>";
    }else{
      finalString += split[i];
    }
  }
  return finalString.substring(1,finalString.length);
});

The problem is that meteor doesn't allow injection, so it will literally show the anchor tag as plain text.

One solution that I thought of was to have a registerHelper for each individual word, but that seems rather foolish.

How can I efficiently get around this rule?


Solution

  • I believe this should do it:

    {{{formatChat text}}}