fix: Render not permitted html tags as text instead of hiding

This commit is contained in:
Christian Kußowski 2025-12-01 14:44:29 +01:00
parent 1ea649f01e
commit 903f7c7d15
No known key found for this signature in database
GPG key ID: E067ECD60F1A0652

View file

@ -156,8 +156,8 @@ class HtmlMessage extends StatelessWidget {
// We must not render elements nested more than 100 elements deep:
if (depth >= 100) return const TextSpan();
// This is a text node, so we render it as text:
if (node is! dom.Element) {
// This is a text node or not permitted node, so we render it as text:
if (node is! dom.Element || !allowedHtmlTags.contains(node.localName)) {
var text = node.text ?? '';
// Single linebreak nodes between Elements are ignored:
if (text == '\n') text = '';
@ -170,9 +170,6 @@ class HtmlMessage extends StatelessWidget {
);
}
// We must not render tags which are not in the allow list:
if (!allowedHtmlTags.contains(node.localName)) return const TextSpan();
switch (node.localName) {
case 'br':
return const TextSpan(text: '\n');