mongo-express/mongo-express
HTML entities silently replaced by editor
Ouverte
#557 ouverte le 5 mars 2020
bughelp wanted
Métriques du dépôt
- Stars
- (5 982 étoiles)
- Métriques de merge PR
- (Merge moyen 4h 48m) (6 PRs mergées en 30 j)
Description
Version: 0.49.0 (official Docker image 'mongo-express' pulled 2019-08-15)
The editor incorrectly changes HTML entities on load. This causes silent roundtrip changes in data when using the document editor.
Example:
- In Mongo Express, create a new document with an html entity:
{
"_id": ObjectID(),
"title" : "A & B"
}
-
Save the document. It is saved correctly: in the documents list view, the title is listed as
A & B -
Now open the document. The entity is loaded incorrectly into the edit pane as
A & B. Make an unrelated edit and save. The silently altered field is saved to the database.
{
"_id": ObjectID(),
"title" : "A & B",
"foo" : "bar"
}
This makes it unsafe to edit any document containing html entities.