post-sanitize location's url in case if stored already #927

backend/app/store/formatter.go

@@ -37,6 +37,7 @@ func NewCommentFormatter(converters ...CommentConverter) *CommentFormatter {
 // Format comment fields
 func (f *CommentFormatter) Format(c Comment) Comment {
 	c.Text = f.FormatText(c.Text)
+	c.Locator.URL = c.sanitizeAsURL(c.Locator.URL) // for urls prior to #927s
 	return c
 }
 

backend/app/store/formatter_test.go

@@ -63,7 +63,7 @@ func TestFormatter_FormatComment(t *testing.T) {
 		User:      User{ID: "username"},
 		ParentID:  "p123",
 		ID:        "123",
-		Locator:   Locator{SiteID: "site", URL: "url"},
+		Locator:   Locator{SiteID: "site", URL: "http://example.com?foo=bar&x=123"},
 		Score:     10,
 		Pin:       true,
 		Deleted:   true,
@@ -77,6 +77,27 @@ func TestFormatter_FormatComment(t *testing.T) {
 	assert.Equal(t, exp, f.Format(comment))
 }
 
+func TestFormatter_FormatCommentXSSLocator(t *testing.T) {
+	comment := Comment{
+		Text:      "blah\n\nxyz",
+		User:      User{ID: "username"},
+		ParentID:  "p123",
+		ID:        "123",
+		Locator:   Locator{SiteID: "site", URL: "javascript:alert('XSS1')"},
+		Score:     10,
+		Pin:       true,
+		Deleted:   true,
+		Timestamp: time.Date(2018, 1, 1, 9, 30, 0, 0, time.Local),
+		Votes:     map[string]bool{"uu": true},
+	}
+
+	f := NewCommentFormatter(mockConverter{})
+	exp := comment
+	exp.Text = "<p>blah</p>\n\n<p>xyz</p>\n!converted"
+	exp.Locator.URL = ""
+	assert.Equal(t, exp, f.Format(comment))
+}
+
 func TestFormatter_ShortenAutoLinks(t *testing.T) {
 	f := NewCommentFormatter(nil)
 	tbl := []struct {