From c59b94a37b9d44f6c56b12f61cbfb80ff5f0db50 Mon Sep 17 00:00:00 2001
From: Sheogorath <sheogorath@shivering-isles.com>
Date: Sat, 10 Nov 2018 20:24:41 +0100
Subject: [PATCH] Remove the xss library from webpack

We can load the xss functions directly from the library instead of
loading them through the expose loader of webpack, this should simplify
the setup and maybe even improve speed a bit.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
---
 public/js/render.js          | 7 +++++--
 public/js/reveal-markdown.js | 4 ++--
 webpack.common.js            | 6 ------
 3 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/public/js/render.js b/public/js/render.js
index 23b8934ec..ff5e2bf2f 100644
--- a/public/js/render.js
+++ b/public/js/render.js
@@ -1,6 +1,8 @@
 /* eslint-env browser, jquery */
-/* global filterXSS */
 // allow some attributes
+
+var filterXSS = require('xss')
+
 var whiteListAttr = ['id', 'class', 'style']
 window.whiteListAttr = whiteListAttr
 // allow link starts with '.', '/' and custom protocol with '://', exclude link starts with javascript://
@@ -71,5 +73,6 @@ function preventXSS (html) {
 window.preventXSS = preventXSS
 
 module.exports = {
-  preventXSS: preventXSS
+  preventXSS: preventXSS,
+  escapeAttrValue: filterXSS.escapeAttrValue
 }
diff --git a/public/js/reveal-markdown.js b/public/js/reveal-markdown.js
index d15b5ebd8..ad5bfd048 100644
--- a/public/js/reveal-markdown.js
+++ b/public/js/reveal-markdown.js
@@ -1,6 +1,6 @@
 /* eslint-env browser, jquery */
 
-import { preventXSS } from './render'
+import { preventXSS, escapeAttrValue } from './render'
 import { md } from './extra'
 
 /**
@@ -259,7 +259,7 @@ import { md } from './extra'
       while ((matchesClass = mardownClassRegex.exec(classes))) {
         var name = matchesClass[1]
         var value = matchesClass[2]
-        if (name.substr(0, 5) === 'data-' || window.whiteListAttr.indexOf(name) !== -1) { elementTarget.setAttribute(name, window.filterXSS.escapeAttrValue(value)) }
+        if (name.substr(0, 5) === 'data-' || window.whiteListAttr.indexOf(name) !== -1) { elementTarget.setAttribute(name, escapeAttrValue(value)) }
       }
       return true
     }
diff --git a/webpack.common.js b/webpack.common.js
index 1fbf247d1..1e9c0707f 100644
--- a/webpack.common.js
+++ b/webpack.common.js
@@ -202,7 +202,6 @@ module.exports = {
       'babel-polyfill',
       'script-loader!jquery-ui-resizable',
       'script-loader!js-url',
-      'expose-loader?filterXSS!xss',
       'script-loader!Idle.Js',
       'expose-loader?LZString!lz-string',
       'script-loader!codemirror',
@@ -253,7 +252,6 @@ module.exports = {
       'script-loader!handlebars',
       'expose-loader?hljs!highlight.js',
       'expose-loader?emojify!emojify.js',
-      'expose-loader?filterXSS!xss',
       'script-loader!Idle.Js',
       'script-loader!gist-embed',
       'expose-loader?LZString!lz-string',
@@ -273,7 +271,6 @@ module.exports = {
     ],
     pretty: [
       'babel-polyfill',
-      'expose-loader?filterXSS!xss',
       'flowchart.js',
       'js-sequence-diagrams',
       'expose-loader?RevealMarkdown!reveal-markdown',
@@ -298,7 +295,6 @@ module.exports = {
       'script-loader!handlebars',
       'expose-loader?hljs!highlight.js',
       'expose-loader?emojify!emojify.js',
-      'expose-loader?filterXSS!xss',
       'script-loader!gist-embed',
       'flowchart.js',
       'js-sequence-diagrams',
@@ -310,7 +306,6 @@ module.exports = {
     slide: [
       'babel-polyfill',
       'bootstrap-tooltip',
-      'expose-loader?filterXSS!xss',
       'flowchart.js',
       'js-sequence-diagrams',
       'expose-loader?RevealMarkdown!reveal-markdown',
@@ -338,7 +333,6 @@ module.exports = {
       'script-loader!handlebars',
       'expose-loader?hljs!highlight.js',
       'expose-loader?emojify!emojify.js',
-      'expose-loader?filterXSS!xss',
       'script-loader!gist-embed',
       'flowchart.js',
       'js-sequence-diagrams',