From d2927cfdb9b721f3e71deb569ae2a95953600bf3 Mon Sep 17 00:00:00 2001
From: Alexander Skvortsov <38059171+askvortsov1@users.noreply.github.com>
Date: Thu, 29 Oct 2020 12:53:23 -0400
Subject: [PATCH] Ensure scripts provided by textformatter are run (#2415)

---
 js/src/forum/components/CommentPost.js | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/js/src/forum/components/CommentPost.js b/js/src/forum/components/CommentPost.js
index 277fbdae4..075a18c49 100644
--- a/js/src/forum/components/CommentPost.js
+++ b/js/src/forum/components/CommentPost.js
@@ -56,9 +56,7 @@ export default class CommentPost extends Post {
     ]);
   }
 
-  onupdate(vnode) {
-    super.onupdate();
-
+  refreshContent() {
     const contentHtml = this.isEditing() ? '' : this.attrs.post.contentHtml();
 
     // If the post content has changed since the last render, we'll run through
@@ -66,13 +64,28 @@ export default class CommentPost extends Post {
     // necessary because TextFormatter outputs them for e.g. syntax highlighting.
     if (this.contentHtml !== contentHtml) {
       this.$('.Post-body script').each(function () {
-        eval.call(window, $(this).text());
+        const script = document.createElement('script');
+        script.textContent = this.textContent;
+        Array.from(this.attributes).forEach((attr) => script.setAttribute(attr.name, attr.value));
+        this.parentNode.replaceChild(script, this);
       });
     }
 
     this.contentHtml = contentHtml;
   }
 
+  oncreate(vnode) {
+    super.oncreate(vnode);
+
+    this.refreshContent();
+  }
+
+  onupdate(vnode) {
+    super.onupdate(vnode);
+
+    this.refreshContent();
+  }
+
   isEditing() {
     return app.composer.bodyMatches(EditPostComposer, { post: this.attrs.post });
   }