coming together

static/js/sanitizer.js

@@ -64,14 +64,24 @@
       return window.DOMPurify.sanitize(dirty);
     }
     // Trigger async load so the next call benefits
-    ensureDOMPurifyLoaded().catch(() => {});
+    try {
+      const loader = (window && window.htmlSanitizer && typeof window.htmlSanitizer.ensureDOMPurifyLoaded === 'function')
+        ? window.htmlSanitizer.ensureDOMPurifyLoaded
+        : ensureDOMPurifyLoaded;
+      loader().catch(() => {});
+    } catch (_) {}
     return fallbackSanitize(dirty);
   }
 
   function escapeHtml(text) {
-    const span = document.createElement('span');
-    span.textContent = String(text == null ? '' : text);
-    return span.innerHTML;
+    // Encode &, <, >, ", and '
+    const str = String(text == null ? '' : text);
+    return str
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&#39;');
   }
 
   function setSafeHTML(element, html) {