Rosa Gutierrez c1ad057db8 Escape the OpenGraph image URL in link previews ...

Pasting a link builds the preview by interpolating the unfurled metadata
into an HTML string. The image URL went into src="..." unescaped, so a
page whose og:image carries a double quote closes the attribute early and
everything after it becomes attributes on the preview's img element.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0186eyzivcTn6wqjEE4Wnxdt

2026-09-11 21:10:57 +02:00

..

channels

Scope the unread rooms stream per user

2026-08-03 14:55:19 -07:00

controllers

Escape the OpenGraph image URL in link previews

2026-09-11 21:10:57 +02:00

fixtures

Allow bots to delete their own boosts

2026-08-11 14:13:01 +02:00

helpers

Harden message content filtering + bump thruster to 0.1.23 (#237)

2026-08-10 15:55:02 -07:00

lib

Redact bot key from request logs (#269)

2026-09-01 12:40:55 -07:00

models

Guard push-subscription endpoints against SSRF (#265)

2026-08-28 11:44:39 -07:00

performance

Hello world

2025-08-21 09:31:59 +01:00

system

Escape the OpenGraph image URL in link previews

2026-09-11 21:10:57 +02:00

test_helpers

Guard push-subscription endpoints against SSRF (#265)

2026-08-28 11:44:39 -07:00

application_system_test_case.rb

Hello world

2025-08-21 09:31:59 +01:00

test_helper.rb

Guard push-subscription endpoints against SSRF (#265)

2026-08-28 11:44:39 -07:00