Merge pull request #137 from QURIresearch/fix-xss

Fix XSS issue with Squiggle Editor

packages/components/src/SquiggleEditor.tsx

@@ -25,11 +25,7 @@ export interface SquiggleEditorProps {
   onEnvChange?(env: exportEnv): void;
 }
 
-const highlight = (editor: HTMLInputElement) => {
+const highlight = (_: HTMLInputElement) => {};
-  let code = editor.textContent;
-  code = code.replace(/\((\w+?)(\b)/g, '(<font color="#8a2be2">$1</font>$2');
-  editor.innerHTML = code;
-};
 
 interface SquiggleEditorState {
   expression: string;

packages/components/src/stories/SquiggleEditor.stories.mdx

@@ -0,0 +1,22 @@
+import { SquiggleEditor } from "../SquiggleEditor";
+import { Canvas, Meta, Story, Props } from "@storybook/addon-docs";
+
+<Meta title="Squiggle/SquiggleEditor" component={SquiggleEditor} />
+
+export const Template = (props) => <SquiggleEditor {...props} />;
+
+# Squiggle Editor
+
+Squiggle Editor is a Squiggle chart with a text editor included for changing
+the distribution.
+
+<Canvas>
+  <Story
+    name="Normal"
+    args={{
+      initialSquiggleString: "normal(5,2)",
+    }}
+  >
+    {Template.bind({})}
+  </Story>
+</Canvas>