From ec203f7f795766f76b55fecc9248168c1cdf6c99 Mon Sep 17 00:00:00 2001
From: syuilo <syuilotan@yahoo.co.jp>
Date: Sun, 25 Oct 2020 12:25:13 +0900
Subject: [PATCH] Use MFM instead of v-html to avoid XSS

---
 src/client/components/dialog.vue | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/client/components/dialog.vue b/src/client/components/dialog.vue
index 810f4284c..f157a37ea 100644
--- a/src/client/components/dialog.vue
+++ b/src/client/components/dialog.vue
@@ -12,8 +12,8 @@
 			<Fa :icon="faQuestionCircle" v-if="type === 'question'"/>
 			<Fa :icon="faSpinner" pulse v-if="type === 'waiting'"/>
 		</div>
-		<header v-if="title" v-html="title"></header>
-		<div class="body" v-if="text" v-html="text"></div>
+		<header v-if="title"><Mfm :text="title"/></header>
+		<div class="body" v-if="text"><Mfm :text="text"/></div>
 		<MkInput v-if="input" v-model:value="inputValue" autofocus :type="input.type || 'text'" :placeholder="input.placeholder" @keydown="onInputKeydown"></MkInput>
 		<MkSelect v-if="select" v-model:value="selectedValue" autofocus>
 			<template v-if="select.items">