From 90b77ce994a1985f613693efab57d4a893a02f9a Mon Sep 17 00:00:00 2001
From: Gabriel Henriques <gabriel.henriques@rocket.chat>
Date: Wed, 5 Feb 2020 13:02:54 -0300
Subject: [PATCH 1/3] Removed one layer of HTML parsing

---
 app/markdown/lib/parser/original/markdown.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/markdown/lib/parser/original/markdown.js b/app/markdown/lib/parser/original/markdown.js
index 7f047bd1204a0..8a4077aa2e190 100644
--- a/app/markdown/lib/parser/original/markdown.js
+++ b/app/markdown/lib/parser/original/markdown.js
@@ -81,7 +81,7 @@ const parseNotEscaped = function(msg, message) {
 			return match;
 		}
 		const target = url.indexOf(Meteor.absoluteUrl()) === 0 ? '' : '_blank';
-		return addAsToken(message, `<a href="${ s.escapeHTML(url) }" title="${ s.escapeHTML(title) }" target="${ s.escapeHTML(target) }" rel="noopener noreferrer"><div class="inline-image" style="background-image: url(${ s.escapeHTML(url) });"></div></a>`);
+		return addAsToken(message, `<a href="${ url }" title="${ title }" target="${ target }" rel="noopener noreferrer"><div class="inline-image" style="background-image: url(${ url });"></div></a>`);
 	});
 
 	// Support [Text](http://link)
@@ -92,10 +92,10 @@ const parseNotEscaped = function(msg, message) {
 		const target = url.indexOf(Meteor.absoluteUrl()) === 0 ? '' : '_blank';
 		title = title.replace(/&amp;/g, '&');
 
-		let escapedUrl = s.escapeHTML(url);
+		let escapedUrl = url;
 		escapedUrl = escapedUrl.replace(/&amp;/g, '&');
 
-		return addAsToken(message, `<a href="${ escapedUrl }" target="${ s.escapeHTML(target) }" rel="noopener noreferrer">${ s.escapeHTML(title) }</a>`);
+		return addAsToken(message, `<a href="${ escapedUrl }" target="${ target }" rel="noopener noreferrer">${ title }</a>`);
 	});
 
 	// Support <http://link|Text>
@@ -104,7 +104,7 @@ const parseNotEscaped = function(msg, message) {
 			return match;
 		}
 		const target = url.indexOf(Meteor.absoluteUrl()) === 0 ? '' : '_blank';
-		return addAsToken(message, `<a href="${ s.escapeHTML(url) }" target="${ s.escapeHTML(target) }" rel="noopener noreferrer">${ s.escapeHTML(title) }</a>`);
+		return addAsToken(message, `<a href="${ url }" target="${ target }" rel="noopener noreferrer">${ title }</a>`);
 	});
 
 	return msg;

From 6d8526d107f0cd15bb0171e101d4c85e00da1b9d Mon Sep 17 00:00:00 2001
From: Gabriel Henriques <gabriel.henriques@rocket.chat>
Date: Wed, 5 Feb 2020 13:05:49 -0300
Subject: [PATCH 2/3] linting

---
 app/markdown/lib/parser/original/markdown.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/app/markdown/lib/parser/original/markdown.js b/app/markdown/lib/parser/original/markdown.js
index 8a4077aa2e190..25875d6b9ba3a 100644
--- a/app/markdown/lib/parser/original/markdown.js
+++ b/app/markdown/lib/parser/original/markdown.js
@@ -4,7 +4,6 @@
  */
 import { Meteor } from 'meteor/meteor';
 import { Random } from 'meteor/random';
-import s from 'underscore.string';
 
 import { settings } from '../../../../settings';
 

From 3ee1412f1af8e9529e44be662fad8a46bf5611c9 Mon Sep 17 00:00:00 2001
From: Gabriel Henriques <gabriel.henriques@rocket.chat>
Date: Wed, 5 Feb 2020 13:38:28 -0300
Subject: [PATCH 3/3] Fixed tests

---
 app/markdown/tests/client.tests.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/markdown/tests/client.tests.js b/app/markdown/tests/client.tests.js
index 808eaddf918d1..7568ba96131d2 100644
--- a/app/markdown/tests/client.tests.js
+++ b/app/markdown/tests/client.tests.js
@@ -14,7 +14,7 @@ const italicWrapper = (text) => wrapper(`<em>${ text }</em>`, '_');
 const strikeWrapper = (text) => wrapper(`<strike>${ text }</strike>`, '~');
 const headerWrapper = (text, level) => `<h${ level }>${ text }</h${ level }>`;
 const quoteWrapper = (text) => `<blockquote class="background-transparent-darker-before"><span class="copyonly">&gt;</span>${ text }</blockquote>`;
-const linkWrapped = (link, title) => `<a href="${ s.escapeHTML(link) }" target="_blank" rel="noopener noreferrer">${ s.escapeHTML(title) }</a>`;
+const linkWrapped = (link, title) => `<a href="${ link }" target="_blank" rel="noopener noreferrer">${ title }</a>`;
 const inlinecodeWrapper = (text) => wrapper(`<span><code class="code-colors inline">${ text }</code></span>`, '`');
 const codeWrapper = (text, lang) => `<pre><code class='code-colors hljs ${ lang }'><span class='copyonly'>\`\`\`<br></span>${ text }<span class='copyonly'><br>\`\`\`</span></code></pre>`;