# How to override a method in post-cooked.js.es6 in a plugin?
**URL:** https://meta.discourse.org/t/how-to-override-a-method-in-post-cooked-js-es6-in-a-plugin/120613
**Category:** Development
**Created:** [17 ביוני, 2019, 9:15pm UTC](https://meta.discourse.org/t/how-to-override-a-method-in-post-cooked-js-es6-in-a-plugin/120613 "2019-06-17T21:15:37Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@sachinsiby](https://meta.discourse.org/u/sachinsiby)
#### Post date: [17 ביוני, 2019, 9:15pm UTC](https://meta.discourse.org/t/how-to-override-a-method-in-post-cooked-js-es6-in-a-plugin/120613/1 "2019-06-17T21:15:37Z")
Hi,
I’d like to customize the reply/embedded-post. This requires a modification to the `_computeCooked` method in [post-cooked](https://github.com/discourse/discourse/blob/master/app/assets/javascripts/discourse/widgets/post-cooked.js.es6) via a plugin; essentially when this.attrs.embeddedPost is true, render something else.
I noticed it’s easier to override or reopen ‘conventional’ Ember classes or the widgets created using ‘createWidget’. What would be the best way to achieve this for the PostCooked class?
---
### Author:  [@spirobel](https://meta.discourse.org/u/spirobel)
#### Post date: [27 ביוני, 2020, 8:30am UTC](https://meta.discourse.org/t/how-to-override-a-method-in-post-cooked-js-es6-in-a-plugin/120613/2 "2020-06-27T08:30:51Z")
did you manage to find a solution to this? I would be very glad if you could share it.
---
### Author:  [@fzngagan](https://meta.discourse.org/u/fzngagan)
#### Post date: [27 ביוני, 2020, 8:32am UTC](https://meta.discourse.org/t/how-to-override-a-method-in-post-cooked-js-es6-in-a-plugin/120613/3 "2020-06-27T08:32:44Z")
does `api.decorateCooked` not suffice?
---
### Author:  [@spirobel](https://meta.discourse.org/u/spirobel)
#### Post date: [27 ביוני, 2020, 8:36am UTC](https://meta.discourse.org/t/how-to-override-a-method-in-post-cooked-js-es6-in-a-plugin/120613/4 "2020-06-27T08:36:47Z")
I am not sure. I didnt look into it yet. I want to replace
[discourse/app/assets/javascripts/discourse/app/widgets/post-cooked.js at eab560fe2aa9053f6d227d29ec6c1ad0939ea940 · discourse/discourse · GitHub](https://github.com/discourse/discourse/blob/eab560fe2aa9053f6d227d29ec6c1ad0939ea940/app/assets/javascripts/discourse/app/widgets/post-cooked.js#L303)
\_computedCooked by category.
I want to replace
```javascript
cookedDiv.innerHTML = this.attrs.cooked;
```
with custom content depending on the category. But it makes sense. this should also be possible with decorateCooked. after reading a bit it seems like decorateCookedElement might be the right one, as I dont want to use jquery. Thaaanks 😃
---
### Author:  [@spirobel](https://meta.discourse.org/u/spirobel)
#### Post date: [28 ביוני, 2020, 7:57am UTC](https://meta.discourse.org/t/how-to-override-a-method-in-post-cooked-js-es6-in-a-plugin/120613/5 "2020-06-28T07:57:32Z")
After messing around for one day I came across this answer.
> [@A tour of how the Widget (Virtual DOM) code in Discourse works](https://meta.discourse.org/t/a-tour-of-how-the-widget-virtual-dom-code-in-discourse-works/40347/10):
>
> Is it possible to mount a widget into a post from decorateCooked? The polls plugin seems to do some funky stuff with Ember components/controllers/templates, and a set of widgets seem like they might be easier to work with.
seems like this was a wasted effort and I need to go a different route.
when I am setting elem.innerHTML to `<script>alert(1)</script> ` it becomes unescaped. (i see while I type this in the composer, that it will be removed in the preview if I type it unescaped.) is this a problem or will CSP stop it?
[https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243!](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243!) [csp error|690x191](https://meta.discourse.org/uploads/short-url/10w9dF6kuG5hZOc2p9b07C6CpF8.png)
posts including script tags as part of an explanation also seem to create these CSP errors. I am really confused now. Do I need to worry about stored xss at all, or will CSP just block it? in the composer i use ckeditor which prevents from selfxss. If I need to worry about it, it seems like I need to prune unsafe tags. I just do
```ruby
value = Loofah.fragment(value).scrub!(:escape).to_s
```
at the moment, but it seems to have no effect at all because setting elem.innerHTML to this value will just unescape the html entities.
EDIT: I finally found the source of my confusion: inspect element will not show you the real html. it will convert html entities already.
if you click on editashtml in the inspector, it becomes clear that everything is actually fine. seeing otherwise invisible tags being rendered should have already pointed me in this direction.