How to override a method in post-cooked.js.es6 in a plugin?

[sachinsiby]

Hi,

I’d like to customize the reply/embedded-post. This requires a modification to the _computeCooked method in post-cooked via a plugin; essentially when this.attrs.embeddedPost is true, render something else.

I noticed it’s easier to override or reopen ‘conventional’ Ember classes or the widgets created using ‘createWidget’. What would be the best way to achieve this for the PostCooked class?

[spirobel]

did you manage to find a solution to this? I would be very glad if you could share it.

[fzngagan (Faizaan Gagan)]

does api.decorateCooked not suffice?

[spirobel]

I am not sure. I didnt look into it yet. I want to replace
https://github.com/discourse/discourse/blob/eab560fe2aa9053f6d227d29ec6c1ad0939ea940/app/assets/javascripts/discourse/app/widgets/post-cooked.js#L303
_computedCooked by category.
I want to replace

 cookedDiv.innerHTML = this.attrs.cooked;

with custom content depending on the category. But it makes sense. this should also be possible with decorateCooked. after reading a bit it seems like decorateCookedElement might be the right one, as I dont want to use jquery. Thaaanks

[spirobel]

After messing around for one day I came across this answer.

A tour of how the Widget (Virtual DOM) code in Discourse works

Is it possible to mount a widget into a post from decorateCooked? The polls plugin seems to do some funky stuff with Ember components/controllers/templates, and a set of widgets seem like they might be easier to work with.

seems like this was a wasted effort and I need to go a different route.
when I am setting elem.innerHTML to <script>alert(1)</script> it becomes unescaped. (i see while I type this in the composer, that it will be removed in the preview if I type it unescaped.) is this a problem or will CSP stop it?
https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243!csp error|690x191
posts including script tags as part of an explanation also seem to create these CSP errors. I am really confused now. Do I need to worry about stored xss at all, or will CSP just block it? in the composer i use ckeditor which prevents from selfxss. If I need to worry about it, it seems like I need to prune unsafe tags. I just do

  value = Loofah.fragment(value).scrub!(:escape).to_s

at the moment, but it seems to have no effect at all because setting elem.innerHTML to this value will just unescape the html entities.
EDIT: I finally found the source of my confusion: inspect element will not show you the real html. it will convert html entities already.

if you click on editashtml in the inspector, it becomes clear that everything is actually fine. seeing otherwise invisible tags being rendered should have already pointed me in this direction.