Merge pull request #5497 from formio/revert-5418-FIO-7544-html-saniti…

…zation-issue

Revert "FIO-7544: Fixes an issue where scripts inside HTML component will be executed during interpolation"

src/components/html/HTML.js

@@ -45,15 +45,13 @@ export default class HTMLComponent extends Component {
     }
 
     const submission = _.get(this.root, 'submission', {});
-    const content = this.component.content ? this.interpolate(
-      this.sanitize(this.component.content, this.shouldSanitizeValue),
-      {
-        metadata: submission.metadata || {},
-        submission: submission,
-        data: this.rootValue,
-        row: this.data
+    const content = this.component.content ? this.interpolate(this.component.content, {
+      metadata: submission.metadata || {},
+      submission: submission,
+      data: this.rootValue,
+      row: this.data
     }) : '';
-    return content;
+    return this.sanitize(content, this.shouldSanitizeValue);
   }
 
   get singleTags() {

src/components/html/HTML.unit.js

@@ -1,13 +1,11 @@
-import Webform from '../../Webform';
 import Harness from '../../../test/harness';
 import HTMLComponent from './HTML';
 import sinon from 'sinon';
 import assert from 'power-assert';
 
 import {
   comp1,
-  comp2,
-  comp3,
+  comp2
 } from './fixtures';
 
 describe('HTML Component', () => {
@@ -32,18 +30,4 @@ describe('HTML Component', () => {
       assert.equal(emit.callCount, 0);
     });
   });
-
-  it('Should not execute scripts inside HTML component', (done) => {
-    const formElement = document.createElement('div');
-    const form = new Webform(formElement);
-
-    const alert = sinon.spy(window, 'alert');
-    form.setForm(comp3).then(() => {
-      setTimeout(() => {
-        assert.equal(alert.callCount, 0);
-        done();
-      }, 200);
-    })
-      .catch(done);
-  });
 });

src/components/html/fixtures/index.js

@@ -1,4 +1,3 @@
 import comp1 from './comp1';
 import comp2 from './comp2';
-import comp3 from './comp3';
-export { comp1, comp2, comp3 };
+export { comp1, comp2 };