From 8ed43a13297be72473f7dd6899413b7129ee0e0e Mon Sep 17 00:00:00 2001
From: Kyle Shockey <shockey@users.noreply.github.com>
Date: Tue, 4 Jul 2017 19:12:43 -0700
Subject: [PATCH] Ensure OAS3 Markdown fields are sanitized

---
 src/core/components/providers/markdown.jsx    | 20 +++++++++++--------
 .../plugins/oas3/wrap-components/markdown.js  |  3 ++-
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/src/core/components/providers/markdown.jsx b/src/core/components/providers/markdown.jsx
index d058d176..7c8806b8 100644
--- a/src/core/components/providers/markdown.jsx
+++ b/src/core/components/providers/markdown.jsx
@@ -2,15 +2,8 @@ import React, { PropTypes } from "react"
 import Remarkable from "react-remarkable"
 import sanitize from "sanitize-html"
 
-const sanitizeOptions = {
-  textFilter: function(text) {
-    return text
-      .replace(/&quot;/g, "\"")
-  }
-}
-
 function Markdown({ source }) {
-  const sanitized = sanitize(source, sanitizeOptions)
+  const sanitized = sanitizer(source)
   return <Remarkable
     options={{html: true, typographer: true, linkify: true, linkTarget: "_blank"}}
     source={sanitized}
@@ -22,3 +15,14 @@ Markdown.propTypes = {
 }
 
 export default Markdown
+
+const sanitizeOptions = {
+  textFilter: function(text) {
+    return text
+      .replace(/&quot;/g, "\"")
+  }
+}
+
+export function sanitizer(str) {
+  return sanitize(str, sanitizeOptions)
+}
diff --git a/src/core/plugins/oas3/wrap-components/markdown.js b/src/core/plugins/oas3/wrap-components/markdown.js
index 7c1b837f..9470eaab 100644
--- a/src/core/plugins/oas3/wrap-components/markdown.js
+++ b/src/core/plugins/oas3/wrap-components/markdown.js
@@ -1,10 +1,11 @@
 import React from "react"
 import ReactMarkdown from "react-markdown"
 import { OAS3ComponentWrapFactory } from "../helpers"
+import { sanitizer } from "core/components/providers/markdown"
 
 export default OAS3ComponentWrapFactory(({ source }) => { return source ? (
   <ReactMarkdown
-    source={source}
+    source={sanitizer(source)}
     className={"renderedMarkdown"}
     />
 ) : null})