Strip html from emoji stuff.

2 files changed, 7 insertions, 1 deletions

diff --git a/lib/pleroma/formatter.ex b/lib/pleroma/formatter.ex
index fdf91f56e..fd8465c1c 100644
--- a/lib/pleroma/formatter.ex
+++ b/lib/pleroma/formatter.ex
@@ -132,6 +132,8 @@ defmodule Pleroma.Formatter do
     end
 
     Enum.reduce(all_emoji, text, fn ({emoji, file}, text) ->
+      emoji = HtmlSanitizeEx.strip_tags(emoji)
+      file = HtmlSanitizeEx.strip_tags(file)
       String.replace(text, ":#{emoji}:", "<img height='32px' width='32px' alt='#{emoji}' title='#{emoji}' src='#{MediaProxy.url(file)}' />")
     end)
   end
diff --git a/lib/pleroma/web/mastodon_api/views/status_view.ex b/lib/pleroma/web/mastodon_api/views/status_view.ex
index 55675ae1c..170b6ac6c 100644
--- a/lib/pleroma/web/mastodon_api/views/status_view.ex
+++ b/lib/pleroma/web/mastodon_api/views/status_view.ex
@@ -77,7 +77,11 @@ defmodule Pleroma.Web.MastodonAPI.StatusView do
     reply_to_user = reply_to && User.get_cached_by_ap_id(reply_to.data["actor"])
 
     emojis = (activity.data["object"]["emoji"] || [])
-    |> Enum.map(fn {name, url} -> %{ shortcode: name, url: url, static_url: url } end)
+    |> Enum.map(fn {name, url} ->
+      name = HtmlSanitizeEx.strip_tags(name)
+      url = HtmlSanitizeEx.strip_tags(url)
+      %{ shortcode: name, url: url, static_url: url }
+    end)
 
     %{
       id: to_string(activity.id),