From 872205754531c071b667e8ac52861a3f13ec9958 Mon Sep 17 00:00:00 2001 From: Rosa Gutierrez Date: Fri, 11 Sep 2026 16:29:29 +0200 Subject: [PATCH] Keep one escapeHTML, and make it safe in an attribute There were two: the one in dom_helpers escaped through a text node, which leaves double quotes alone, so it could not have closed the hole in the link preview's img src. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt --- app/javascript/controllers/composer_controller.js | 2 +- app/javascript/helpers/dom_helpers.js | 6 ------ app/javascript/helpers/string_helpers.js | 2 +- 3 files changed, 2 insertions(+), 8 deletions(-) diff --git a/app/javascript/controllers/composer_controller.js b/app/javascript/controllers/composer_controller.js index 8346def..73365df 100644 --- a/app/javascript/controllers/composer_controller.js +++ b/app/javascript/controllers/composer_controller.js @@ -1,7 +1,7 @@ import { Controller } from "@hotwired/stimulus" import FileUploader from "models/file_uploader" import { onNextEventLoopTick, nextFrame } from "helpers/timing_helpers" -import { escapeHTML } from "helpers/dom_helpers" +import { escapeHTML } from "helpers/string_helpers" export default class extends Controller { static classes = ["toolbar"] diff --git a/app/javascript/helpers/dom_helpers.js b/app/javascript/helpers/dom_helpers.js index 22bc8cb..43862f5 100644 --- a/app/javascript/helpers/dom_helpers.js +++ b/app/javascript/helpers/dom_helpers.js @@ -4,12 +4,6 @@ export function scrollToBottom(container) { container.scrollTop = container.scrollHeight } -export function escapeHTML(html) { - const div = document.createElement("div") - div.textContent = html - return div.innerHTML -} - export function parseHTMLFragment(html) { const template = document.createElement("template") template.innerHTML = html diff --git a/app/javascript/helpers/string_helpers.js b/app/javascript/helpers/string_helpers.js index c21689b..efbb5e9 100644 --- a/app/javascript/helpers/string_helpers.js +++ b/app/javascript/helpers/string_helpers.js @@ -9,5 +9,5 @@ export function truncateString(string, length, omission = "…") { } export function escapeHTML(string) { - return String(string).replace(/[&<>"']/g, character => HTML_ESCAPES[character]) + return String(string ?? "").replace(/[&<>"']/g, character => HTML_ESCAPES[character]) }