From 8b8deb86ed2d734f54c9076bb5283a3b344aa17c Mon Sep 17 00:00:00 2001
From: Aviral Dasgupta <me@aviraldg.com>
Date: Wed, 15 Jun 2016 20:24:37 +0530
Subject: [PATCH] Fix RTE escaping, HTML output with breaks

---
 src/RichText.js | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/RichText.js b/src/RichText.js
index 4ad9369711..450e31e6b9 100644
--- a/src/RichText.js
+++ b/src/RichText.js
@@ -10,7 +10,7 @@ import {
 import * as sdk from  './index';
 
 const BLOCK_RENDER_MAP = DefaultDraftBlockRenderMap.set('unstyled', {
-    element: 'p' // draft uses <div> by default which we don't really like, so we're using <p>
+    element: 'span' // draft uses <div> by default which we don't really like, so we're using <p>
 });
 
 const STYLES = {
@@ -43,11 +43,21 @@ export function contentStateToHTML(contentState: ContentState): string {
                 let open = tags.map(tag => `<${tag}>`).join('');
                 let close = tags.map(tag => `</${tag}>`).reverse().join('');
                 // and get the HTML representation of this styled range (this .substring() should never fail)
-                content.push(`${open}${block.getText().substring(start, end)}${close}`);
+                let text = block.getText().substring(start, end);
+                // http://shebang.brandonmintern.com/foolproof-html-escaping-in-javascript/
+                let div = document.createElement('div');
+                div.appendChild(document.createTextNode(text));
+                let safeText = div.innerHTML;
+                content.push(`${open}${safeText}${close}`);
             }
         );
 
-        return (`<${elem}>${content.join('')}</${elem}>`);
+        let result = `<${elem}>${content.join('')}</${elem}>`;
+
+        // dirty hack because we don't want block level tags by default, but breaks
+        if(elem === 'span')
+            result += '<br />';
+        return result;
     }).join('');
 }