Merge branch 'master' of https://git.loafle.net/ucap-web/next-ucap-messenger

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "ucap-webmessenger",
-  "version": "0.0.5",
+  "version": "0.0.9",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {

projects/ucap-webmessenger-app/src/app/layouts/messenger/components/messages.component.ts

@@ -36,6 +36,7 @@ import {
   of,
   BehaviorSubject
 } from 'rxjs';
+
 import {
   Info,
   EventType,
@@ -472,14 +473,14 @@ export class MessagesComponent implements OnInit, OnDestroy, AfterViewInit {
         return this.loginResSubject.value.userSeq !== roomUserInfo.seq;
       });
     } else {
-    return this.userInfoListSubject.value
-      .filter(roomUserInfo => {
-        return (
-          this.loginResSubject.value.userSeq !== roomUserInfo.seq &&
-          roomUserInfo.isJoinRoom
-        );
-      })
-      .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+      return this.userInfoListSubject.value
+        .filter(roomUserInfo => {
+          return (
+            this.loginResSubject.value.userSeq !== roomUserInfo.seq &&
+            roomUserInfo.isJoinRoom
+          );
+        })
+        .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
     }
   }
 
@@ -733,7 +734,7 @@ export class MessagesComponent implements OnInit, OnDestroy, AfterViewInit {
           roomSeq: this.roomInfoSubject.value.roomSeq,
           eventType: EventType.MassText,
           // sentMessage: message.replace(/\n/gi, '\r\n')
-          sentMessage: message
+          sentMessage: StringUtil.escapeHtml(message)
         }
       })
     );

projects/ucap-webmessenger-ui/src/lib/utils/string.util.ts

@@ -236,4 +236,19 @@ export class StringUtil {
     }
     return eventMessage;
   }
+
+  static escapeHtml(dirty: string): string {
+    return (dirty + '').replace(
+      /[&<>"']/g,
+      m =>
+        ({
+          '&': '&amp;',
+          '<': '&lt;',
+          '>': '&gt;',
+          '"': '&quot;',
+          // tslint:disable-next-line: quotemark
+          "'": '&#39;'
+        }[m])
+    );
+  }
 }