From 16678c4e7a4d904b7dfef4ebf6d368f61db3bf6c Mon Sep 17 00:00:00 2001
From: Dominic Ferrando <mail@dominicferrando.com>
Date: Sun, 23 Aug 2026 18:06:29 -0400
Subject: [PATCH] Patch XSS vuln

---
 internal/util/posts.go | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/internal/util/posts.go b/internal/util/posts.go
index 768ba7f..dfd1d99 100644
--- a/internal/util/posts.go
+++ b/internal/util/posts.go
@@ -50,16 +50,8 @@ func EnrichPost(body string) string {
 	var b strings.Builder
 
 	for _, rawLine := range strings.Split(body, "\n") {
-		line := urlRx.ReplaceAllStringFunc(rawLine, func(u string) string {
-			esc := template.HTMLEscapeString(u)
-			return fmt.Sprintf(
-				`<a href="%[1]s" target="_blank" rel="noopener noreferrer" class="ext-link">%[1]s</a>`,
-				esc,
-			)
-		})
-
 		var outLine string
-		for i, rawWord := range strings.Split(line, " ") {
+		for i, rawWord := range strings.Split(rawLine, " ") {
 			var outWord string
 			if strings.HasPrefix(rawWord, ">>") {
 				postId := strings.TrimPrefix(rawWord, ">>")
@@ -68,8 +60,13 @@ func EnrichPost(body string) string {
 						`onmouseleave="highlightPost(%[1]s,event,false)" href="#post-%[1]s" class="reply-link">%[2]s</a>`,
 					postId, template.HTMLEscapeString(rawWord),
 				)
+			} else if urlRx.MatchString(rawWord) {
+				outWord = fmt.Sprintf(
+					`<a href="%[1]s" target="_blank" rel="noopener noreferrer" class="ext-link">%[1]s</a>`,
+					template.HTMLEscapeString(rawWord),
+				)
 			} else {
-				outWord = rawWord
+				outWord = template.HTMLEscapeString(rawWord)
 			}
 			if i != 0 {
 				outLine += " "