Actually, looking at this it would remove all open and close tags, so it
shouldn't be a problem. At first glance I thought it was removing just the
opening tags and then relying on the browser to remove all the closing tags.
Your comment suggests we rely on the browser for further cleaning - what
are we relying upon the browser to do?
On 6 Mar 2014 12:19, "Juan Leyva" <notifications@github.com> wrote:

> In lib/mm.util.js:
>
> > @@ -157,6 +157,18 @@ MM.util = {
> >      },
> >
> >      /**
> > +     * Function for clean HTML tags
> > +     * @param  {str} text The text to be cleaned
> > +     * @return {str}      Text cleaned
> > +     */
> > +    cleanTags: function(text) {
> > +        // First, we use a regexpr.
> > +        text = text.replace(/(<([^>]+)>)/ig,"");
> > +        // Then, we rely on the browser. We need to wrap the text to be sure is HTML.
>
> Please, can you elaborate more? The approach is cleaning the tags with a
> regexp but then allow the browser to clean the rest for avoid injection of
> tags like
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/moodlehq/moodlemobile/pull/65/files#r10340046>
> .
>