public/once-campfire
1
0 Fork 0
mirror of https://github.com/basecamp/once-campfire.git synced 2026-10-31 17:34:05 +09:00
Code Issues Packages Projects Releases Wiki Activity

Keep one escapeHTML, and make it safe in an attribute

Browse Source 
There were two: the one in dom_helpers escaped through a text node, which
leaves double quotes alone, so it could not have closed the hole in the
link preview's img src.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt
This commit is contained in:
Rosa GutierrezandClaude Opus 5 authored and Rosa Gutierrez committed 2026-09-11 21:10:57 +02:00
1 parent e6022a52c3
commit 8722057545
3 files changed
+2 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

app/javascript/controllers/composer_controller.js
+1 -1
View File
@@ -1,7 +1,7 @@
import { Controller } from "@hotwired/stimulus"
import FileUploader from "models/file_uploader"
import { onNextEventLoopTick, nextFrame } from "helpers/timing_helpers"
import { escapeHTML } from "helpers/dom_helpers"
import { escapeHTML } from "helpers/string_helpers"
export default class extends Controller {
static classes = ["toolbar"]