Double encoding of HTML with third party integration tool

user_155905 0
Viewed 112

We integrate a third-party app, using a javascript code that we need to send an email and name.

This email and name come from a previous step registration form.

Because we need to print on the page that email and name we encode it.

some.survey({
    email: "test@test.pt",
    name: "Mon & Sons",
    properties: {"one":"123","two":"345"}
});

The issue is that the third party before printing is encoding again our string, showing in the browser like: "Mon & Sons".

Does anyone know how to get around this?

encode
2 Answers

Here's a way (based on https://stackoverflow.com/a/784698):

function DecodeHTML(txt) {
  var el = document.createElement("div");
  el.innerHTML = txt;
  return el.innerText;
};

DecodeHTML("Mon & Sons");
//"Mon & Sons"

Edit: watch out for XSS attacks, however. It is possible that the third-party app is doing this to escape any ' into ' and " into ", so you may want to build on the above idea to prevent this, depending on your needs. For example, if you're going to display this information on a HTML page, do so by only setting innerText of an element in that page, e.g. nameelement.innerText = nametext;

user_26872040

sbgib was almost right about how this would work. So, we now output the string as encoded, and decode it with Javascript, before sending it to the external service.

function DecodeHTML(txt) {
  var el = document.createElement("div");
  el.innerHTML = txt;
  return el.innerText;
}

some.survey({
    email: "test@test.pt",
    name: DecodeHTML("Mon & Sons"),
    properties: {"one":"123","two":"345"}
});
user_1559050
Related