From ad9bbf9222bca7327ed0046c7d6c3f2dfeeaf77a Mon Sep 17 00:00:00 2001
From: Baoshuo <i@baoshuo.ren>
Date: Tue, 20 Sep 2022 10:17:28 +0800
Subject: [PATCH] fix: DOMPurify on user self review page

---
 web/app/controllers/user_self_reviews.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/web/app/controllers/user_self_reviews.php b/web/app/controllers/user_self_reviews.php
index fe4df3d..405d4de 100644
--- a/web/app/controllers/user_self_reviews.php
+++ b/web/app/controllers/user_self_reviews.php
@@ -67,7 +67,7 @@
 			$result .= '<td><div id="' . $problem_review_id . '"></div></td>';
 			$esc_problem_self_review = rawurlencode($problem_self_review != null ? $problem_self_review['content'] : '');
 			$result .= '<script type="text/javascript">'
-					 . "$(function() { $('#$problem_review_id').html(DOMPurify.sanitize('{$esc_problem_self_review}', $dom_sanitize_config)); });"
+					 . "$(function() { $('#$problem_review_id').html(DOMPurify.sanitize(decodeURIComponent(\"{$esc_problem_self_review}\"), $dom_sanitize_config)); });"
 					 . '</script>';
 
 			if ($i == 0) {
@@ -76,7 +76,7 @@
 				$esc_contest_self_review = rawurlencode($contest_self_review != null ? $contest_self_review['content'] : '');
 				$result .= '<td rowspan="' . $n_contest_problems . '"><div id="' . $contest_review_id . '"></div></td>';
 				$result .= '<script type="text/javascript">'
-						 . "$(function() { $('#$contest_review_id').html(DOMPurify.sanitize('{$esc_contest_self_review}', $dom_sanitize_config)); });"
+						 . "$(function() { $('#$contest_review_id').html(DOMPurify.sanitize(decodeURIComponent(\"{$esc_contest_self_review}\"), $dom_sanitize_config)); });"
 						 . '</script>';
 			}