From 6d16ac0f0a97d12de3cc2826d3244bb4ed2f9455 Mon Sep 17 00:00:00 2001
From: callebtc <93376500+callebtc@users.noreply.github.com>
Date: Fri, 25 Nov 2022 14:53:03 +0100
Subject: [PATCH] strip html

---
 lnbits/db.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/lnbits/db.py b/lnbits/db.py
index 8ae10f720..0286688bf 100644
--- a/lnbits/db.py
+++ b/lnbits/db.py
@@ -1,6 +1,7 @@
 import asyncio
 import datetime
 import os
+import re
 import time
 from contextlib import asynccontextmanager
 from typing import Optional
@@ -71,6 +72,16 @@ class Connection(Compat):
         if self.type in {POSTGRES, COCKROACH}:
             query = query.replace("%", "%%")
             query = query.replace("?", "%s")
+
+            # strip html
+            CLEANR = re.compile("<.*?>|&([a-z0-9]+|#[0-9]{1,6}|#x[0-9a-f]{1,6});")
+
+            def cleanhtml(raw_html):
+                cleantext = re.sub(CLEANR, "", raw_html)
+                return cleantext
+
+            query = cleanhtml(query)
+
         return query
 
     async def fetchall(self, query: str, values: tuple = ()) -> list: