From eab554aa4bf1e7cc0b09458c115711c4dc0ec679 Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Sat, 26 Sep 2026 09:26:53 +0200
Subject: [PATCH] Adapt the Lexxy composer to main's link preview hardening

Main strips a javascript: href from a preview node before it's parsed, so
tell legacy Trix attachments apart by their filename instead. escapeHTML
moved to the string helpers, and the unfurling system test now drives
the Lexxy editor.
---
 app/javascript/controllers/unfurl_controller.js |  3 +--
 lib/rails_ext/actiontext_opengraph_embeds.rb    |  2 +-
 test/system/unfurling_links_test.rb             | 17 +++--------------
 3 files changed, 5 insertions(+), 17 deletions(-)

diff --git a/app/javascript/controllers/unfurl_controller.js b/app/javascript/controllers/unfurl_controller.js
index e1b0809..82f0e03 100644
--- a/app/javascript/controllers/unfurl_controller.js
+++ b/app/javascript/controllers/unfurl_controller.js
@@ -1,7 +1,6 @@
 import { Controller } from "@hotwired/stimulus"
 import { post } from "@rails/request.js"
-import { truncateString } from "helpers/string_helpers"
-import { escapeHTML } from "helpers/dom_helpers"
+import { escapeHTML, truncateString } from "helpers/string_helpers"
 
 const OPENGRAPH_EMBED_CONTENT_TYPE = "application/vnd.actiontext.opengraph-embed"
 
diff --git a/lib/rails_ext/actiontext_opengraph_embeds.rb b/lib/rails_ext/actiontext_opengraph_embeds.rb
index 7b216e5..d43e1a5 100644
--- a/lib/rails_ext/actiontext_opengraph_embeds.rb
+++ b/lib/rails_ext/actiontext_opengraph_embeds.rb
@@ -20,7 +20,7 @@ class ActionText::Attachment::OpengraphEmbed
       # and content-type, so newer attachments carry the details in their
       # content markup instead.
       def attributes_from_node(node)
-        if node["href"].present?
+        if node["filename"].present?
           {
             href: web_url(node["href"]),
             url: web_url(node["url"]),
diff --git a/test/system/unfurling_links_test.rb b/test/system/unfurling_links_test.rb
index 1471615..7119317 100644
--- a/test/system/unfurling_links_test.rb
+++ b/test/system/unfurling_links_test.rb
@@ -16,29 +16,18 @@ class UnfurlingLinksTest < ApplicationSystemTestCase
   end
 
   test "a quote in the opengraph image URL cannot add attributes to the preview" do
-    paste_into_composer @website.page_url
+    paste_in_composer @website.page_url
 
-    assert_selector "trix-editor .og-embed__title", text: "A normal looking link"
+    assert_selector "#composer lexxy-editor .og-embed__title", text: "A normal looking link"
 
     assert_equal @website.image_url, preview_image_attributes["src"]
     assert_empty preview_image_attributes.keys - %w[ src class alt ]
   end
 
   private
-    def paste_into_composer(url)
-      page.execute_script(<<~JS, url)
-        const editor = document.querySelector("trix-editor")
-        editor.focus()
-
-        const clipboardData = new DataTransfer()
-        clipboardData.setData("text/plain", arguments[0])
-        editor.dispatchEvent(new ClipboardEvent("paste", { clipboardData, bubbles: true, cancelable: true }))
-      JS
-    end
-
     def preview_image_attributes
       page.evaluate_script(<<~JS)
-        Object.fromEntries(Array.from(document.querySelector("trix-editor .og-embed__image img").attributes, attribute => [ attribute.name, attribute.value ]))
+        Object.fromEntries(Array.from(document.querySelector("#composer lexxy-editor .og-embed__image img").attributes, attribute => [ attribute.name, attribute.value ]))
       JS
     end