Applications/comfychan
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 3 Activity

Patch XSS vuln

Browse Source
This commit is contained in:
dominicf
2026-08-23 18:06:29 -04:00
parent 6f3561a7ac
commit 16678c4e7a
1 changed files with 7 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/util/posts.go
+7 -10
View File
@@ -50,16 +50,8 @@ func EnrichPost(body string) string {
var b strings.Builder
for _, rawLine := range strings.Split(body, "\n") {
line := urlRx.ReplaceAllStringFunc(rawLine, func(u string) string {
esc := template.HTMLEscapeString(u)
return fmt.Sprintf(
`<a href="%[1]s" target="_blank" rel="noopener noreferrer" class="ext-link">%[1]s</a>`,
esc,
)
})
var outLine string
for i, rawWord := range strings.Split(line, " ") {
for i, rawWord := range strings.Split(rawLine, " ") {
var outWord string
if strings.HasPrefix(rawWord, ">>") {
postId := strings.TrimPrefix(rawWord, ">>")
@@ -68,8 +60,13 @@ func EnrichPost(body string) string {
`onmouseleave="highlightPost(%[1]s,event,false)" href="#post-%[1]s" class="reply-link">%[2]s</a>`,
postId, template.HTMLEscapeString(rawWord),
)
} else if urlRx.MatchString(rawWord) {
outWord = fmt.Sprintf(
`<a href="%[1]s" target="_blank" rel="noopener noreferrer" class="ext-link">%[1]s</a>`,
template.HTMLEscapeString(rawWord),
)
} else {
outWord = rawWord
outWord = template.HTMLEscapeString(rawWord)
}
if i != 0 {
outLine += " "