diff --git a/backend/app/store/comment.go b/backend/app/store/comment.go index c7ac03ca..1d4b0e13 100644 --- a/backend/app/store/comment.go +++ b/backend/app/store/comment.go @@ -106,7 +106,7 @@ func (c *Comment) Sanitize() { c.Text = p.Sanitize(c.Text) c.Orig = p.Sanitize(c.Orig) c.User.ID = template.HTMLEscapeString(c.User.ID) - c.User.Name = template.HTMLEscapeString(c.User.Name) + c.User.Name = c.escapeHtmlWithSome(c.User.Name) c.User.Picture = p.Sanitize(c.User.Picture) } @@ -130,3 +130,11 @@ func (c *Comment) Snippet(limit int) string { } return string(snippet) + " ..." } + +func (c *Comment) escapeHtmlWithSome(inp string) string { + res := template.HTMLEscapeString(inp) + res = strings.Replace(res, """, "\"", -1) + res = strings.Replace(res, "'", "'", -1) + res = strings.Replace(res, "&", "&", -1) + return res +} diff --git a/backend/app/store/comment_test.go b/backend/app/store/comment_test.go index 1e619735..7fd5a614 100644 --- a/backend/app/store/comment_test.go +++ b/backend/app/store/comment_test.go @@ -43,6 +43,10 @@ func TestComment_Sanitize(t *testing.T) { inp: Comment{Text: "blah & & 123 — —"}, out: Comment{Text: `blah & & 123 — —`}, }, + { + inp: Comment{Text: "blah & & 123", User: User{Name: "name <> & ' ` \""}}, + out: Comment{Text: `blah & & 123`, User: User{Name: "name <> & ' ` \""}}, + }, } for n, tt := range tbl {