From fa4b7a1a695aa199d37f9feabe0f57feb931c88d Mon Sep 17 00:00:00 2001
From: Nick O'Leary <nick.oleary@gmail.com>
Date: Tue, 29 Jun 2021 13:58:24 +0100
Subject: [PATCH] Ensure any html in changelog is escaped before displaying

---
 CHANGELOG.md                                                | 2 +-
 packages/node_modules/@node-red/editor-client/src/js/red.js | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 27e3a76c5..bfb7ad51d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -45,7 +45,7 @@ Editor
  - Update Node-RED Function typings in Monaco (#3008) @Steve-Mcl
  - Add css named variables for certain key colours (#2994) @knolleary
  - Improve contrast of export dialog JSON font color
- - Switch editableList buttons from \<a\> to \<button\> elements
+ - Switch editableList buttons from <a> to <button> elements
  - Add option to RED.nodes.createCompleteNodeSet to include node dimensions
  - Fix css of node help table of contents elements
  - Improve red-ui-node-icon css and add red-ui-node-icon-small modifier class
diff --git a/packages/node_modules/@node-red/editor-client/src/js/red.js b/packages/node_modules/@node-red/editor-client/src/js/red.js
index 7c3576e13..1a7d9b08f 100644
--- a/packages/node_modules/@node-red/editor-client/src/js/red.js
+++ b/packages/node_modules/@node-red/editor-client/src/js/red.js
@@ -540,6 +540,8 @@ var RED = (function() {
 
     function showAbout() {
         $.get('red/about', function(data) {
+            // data will be strictly markdown. Any HTML should be escaped.
+            data = RED.utils.sanitize(data);
             var aboutHeader = '<div style="text-align:center;">'+
             '<img width="50px" src="red/images/node-red-icon.svg" />'+
             '</div>';