Don't render the glossary in the hero section

rage · May 6, 2024 · 74b2a55 · 74b2a55
1 parent a28becd
commit 74b2a55
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 6 deletions.
diff --git a/services/course-material/src/components/ContentRenderer/util/textParsing.tsx b/services/course-material/src/components/ContentRenderer/util/textParsing.tsx
@@ -62,15 +62,27 @@ const parseCitation = (data: string) => {
   return converted
 }
 
-const parseText = (content: string | undefined | StringWithHTML, terms: Term[]) => {
+const parseText = (
+  content: string | undefined | StringWithHTML,
+  terms: Term[],
+  options: { glossary: boolean } = { glossary: true },
+) => {
   const sanitizedHTML = sanitizeCourseMaterialHtml(content)
   const { count, converted: parsedLatex } = convertToLatex(sanitizedHTML)
   const parsedCitation = parseCitation(parsedLatex)
-  const parsedGlossary = parseGlossary(parsedCitation, terms ?? [])
 
-  const hasCitationsOrGlossary = parsedLatex !== parsedGlossary
+  let parsedText = parsedCitation
+  let hasCitationsOrGlossary = false
 
-  return { count, parsedText: parsedGlossary, hasCitationsOrGlossary }
+  if (options.glossary) {
+    parsedText = parseGlossary(parsedCitation, terms ?? [])
+  }
+
+  hasCitationsOrGlossary = parsedLatex !== parsedText
+
+  // Sanitation always needs to be the last step because otherwise we might accidentally introduce injection attacks with our custom parsing and modifications to the string
+  parsedText = sanitizeCourseMaterialHtml(parsedText)
+  return { count, parsedText, hasCitationsOrGlossary }
 }
 
 export { parseText }
diff --git a/services/course-material/src/components/HeroSection.tsx b/services/course-material/src/components/HeroSection.tsx
@@ -148,9 +148,15 @@ const HeroSection: React.FC<React.PropsWithChildren<React.PropsWithChildren<Card
         <span className="chapter">{label}</span>
         <h1
           className={INCLUDE_THIS_HEADING_IN_HEADINGS_NAVIGATION_CLASS}
-          dangerouslySetInnerHTML={{ __html: parseText(title, terms).parsedText }}
+          dangerouslySetInnerHTML={{
+            __html: parseText(title, terms, { glossary: false }).parsedText,
+          }}
+        />
+        <span
+          dangerouslySetInnerHTML={{
+            __html: parseText(subtitle, terms, { glossary: false }).parsedText,
+          }}
         />
-        <span dangerouslySetInnerHTML={{ __html: parseText(subtitle, terms).parsedText }} />
       </TextBox>
     </div>
   )