From 1694accbf821926df534bea0ba79ea43268bee5f Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Sat, 26 Sep 2026 10:04:38 +0200
Subject: [PATCH] Let tables through the message sanitizers

Lexxy imports pasted and Markdown tables, and the tag sanitizer dropped
them with everything in them on render.
---
 app/helpers/content_filters.rb       |  2 +-
 test/helpers/content_filters_test.rb | 10 ++++++++++
 test/system/composer_test.rb         |  6 +++---
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/app/helpers/content_filters.rb b/app/helpers/content_filters.rb
index 42f80f7..0b9ee14 100644
--- a/app/helpers/content_filters.rb
+++ b/app/helpers/content_filters.rb
@@ -6,7 +6,7 @@ module ContentFilters
   #   * SanitizeTags strips disallowed markup from the message body
   #   * Action Text sanitizes the rendered content (lib/rails_ext/action_text_allowed_tags.rb)
   #   * auto_link re-sanitizes the final html (MessagesHelper#message_presentation)
-  EDITOR_FORMATTING_TAGS = %w[ s u mark ]
+  EDITOR_FORMATTING_TAGS = %w[ s u mark table thead tbody tfoot tr th td ]
   EDITOR_FORMATTING_ATTRIBUTES = %w[ data-language ]
 
   TextMessagePresentationFilters = ActionText::Content::Filters.new(RemoveSoloUnfurledLinkText, SanitizeTags, SanitizeAttributes)
diff --git a/test/helpers/content_filters_test.rb b/test/helpers/content_filters_test.rb
index ad49078..c9ecb63 100644
--- a/test/helpers/content_filters_test.rb
+++ b/test/helpers/content_filters_test.rb
@@ -158,6 +158,16 @@ class ContentFiltersTest < ActionView::TestCase
     assert_match /<action-text-attachment sgid="#{users(:david).attachable_sgid}"/, filtered
   end
 
+  test "message with a table keeps the table" do
+    body = "<figure class=\"lexxy-content__table-wrapper\"><table><tbody><tr><th><p>Name</p></th></tr><tr><td><p>Jason</p></td></tr></tbody></table></figure>"
+    message = Message.create! room: rooms(:pets), body: body, client_message_id: "0016", creator: users(:jason)
+
+    filtered = ContentFilters::TextMessagePresentationFilters.apply(message.body.body).to_html
+
+    assert_equal body, filtered
+    assert_match %r{<table>.*<th><p>Name</p></th>.*<td><p>Jason</p></td>}m, message_presentation(message)
+  end
+
   test "message with a mention attachment" do
     message = Message.create! room: rooms(:pets), body: "<div>Hey #{mention_attachment_for(:david)}</div>", creator: users(:jason)
 
diff --git a/test/system/composer_test.rb b/test/system/composer_test.rb
index 764cbea..ab409b6 100644
--- a/test/system/composer_test.rb
+++ b/test/system/composer_test.rb
@@ -103,15 +103,15 @@ class ComposerTest < ApplicationSystemTestCase
     assert_equal [ users(:jason) ], message.reload.mentionees
   end
 
-  test "pasting a table keeps its text" do
+  test "pasting a table sends it as a table" do
     paste_in_composer "Name Points\nJason 10", html: "<table><tr><th>Name</th><th>Points</th></tr><tr><td>Jason</td><td>10</td></tr></table>"
 
     assert_selector "#composer lexxy-editor table"
 
     click_send_button
 
-    assert_message_text /Name Points\s*Jason 10/
-    assert_no_selector last_message_selector("table")
+    assert_selector last_message_selector("table th"), text: "Name"
+    assert_selector last_message_selector("table td"), text: "10"
   end
 
   test "replying quotes the original message with attribution" do