From dd6e7fd7ad18755ebe58e9c18ce15cb4e3cbc2be Mon Sep 17 00:00:00 2001
From: Dillon Dumesnil <ddumesnil@edx.org>
Date: Thu, 9 Apr 2020 06:23:16 -0700
Subject: [PATCH] Exclude script and style tags content

Also removing the exclusion of link since links never have content
---
 common/static/common/js/utils/clamp-html.js       | 2 +-
 common/static/common/js/utils/clamp-html.test.jsx | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/common/static/common/js/utils/clamp-html.js b/common/static/common/js/utils/clamp-html.js
index 9486e1ac6e..4d123e669b 100644
--- a/common/static/common/js/utils/clamp-html.js
+++ b/common/static/common/js/utils/clamp-html.js
@@ -12,7 +12,7 @@
 function clampHtmlByWords(root, wordsLeft) {
     'use strict';
 
-    if (root.nodeName === 'SCRIPT' || root.nodeName === 'LINK') {
+    if (root.nodeName === 'SCRIPT' || root.nodeName === 'STYLE') {
         return wordsLeft; // early exit and ignore
     }
 
diff --git a/common/static/common/js/utils/clamp-html.test.jsx b/common/static/common/js/utils/clamp-html.test.jsx
index 02b8b5ab94..0f08678446 100644
--- a/common/static/common/js/utils/clamp-html.test.jsx
+++ b/common/static/common/js/utils/clamp-html.test.jsx
@@ -3,8 +3,8 @@ import ReactDOM from 'react-dom';
 import { clampHtmlByWords } from './clamp-html';
 
 let container;
-const scriptTag = '<script src="/asset-v1:edX+testX+1T2021+type@asset+block/script.js"></script>';
-const stylesheet = '<link rel="stylesheet" type="text/css" href="/asset-v1:edX+testX+1T2021+type@asset+block/introjs.css">';
+const scriptTag = '<script src="/asset-v1:edX+testX+1T2021+type@asset+block/script.js">const ignore = "me here"; alert("BAD");</script>';
+const styleTag = '<style>h1 {color: orange;}</style>';
 
 beforeEach(() => {
   container = document.createElement("div");
@@ -28,8 +28,8 @@ describe('ClampHtml', () => {
     ['a <i>aa <em>aaa</em> ab</i>', 3, 'a <i>aa <em>aaa…</em></i>'],
     ['a <i>aa ab</i> b c', 4, 'a <i>aa ab</i> b…'],
     [scriptTag + 'a b c', 2, scriptTag + 'a b…'],
-    [stylesheet + 'a b c', 2, stylesheet + 'a b…'],
-    [scriptTag + stylesheet + 'a b c', 2, scriptTag + stylesheet + 'a b…'],
+    [styleTag + 'a b c', 2, styleTag + 'a b…'],
+    [scriptTag + styleTag + 'a b c', 2, scriptTag + styleTag + 'a b…'],
   ])('clamps by words: %s, %i', (input, wordsLeft, expected) => {
     const div = ReactDOM.render(<div dangerouslySetInnerHTML={{ __html: input }} />, container);
     clampHtmlByWords(div, wordsLeft);