From 47fee90c60c6415d7fc50a403a0d1b1b9b851281 Mon Sep 17 00:00:00 2001
From: Umputun <umputun@gmail.com>
Date: Fri, 26 Mar 2021 15:37:53 -0500
Subject: [PATCH] post-sanitize location's url in case if stored already #927

---
 backend/app/store/formatter.go      |  1 +
 backend/app/store/formatter_test.go | 23 ++++++++++++++++++++++-
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/backend/app/store/formatter.go b/backend/app/store/formatter.go
index 0522eef9..613cb272 100644
--- a/backend/app/store/formatter.go
+++ b/backend/app/store/formatter.go
@@ -37,6 +37,7 @@ func NewCommentFormatter(converters ...CommentConverter) *CommentFormatter {
 // Format comment fields
 func (f *CommentFormatter) Format(c Comment) Comment {
 	c.Text = f.FormatText(c.Text)
+	c.Locator.URL = c.sanitizeAsURL(c.Locator.URL) // for urls prior to #927s
 	return c
 }
 
diff --git a/backend/app/store/formatter_test.go b/backend/app/store/formatter_test.go
index 29af0224..68a35b6c 100644
--- a/backend/app/store/formatter_test.go
+++ b/backend/app/store/formatter_test.go
@@ -63,7 +63,7 @@ func TestFormatter_FormatComment(t *testing.T) {
 		User:      User{ID: "username"},
 		ParentID:  "p123",
 		ID:        "123",
-		Locator:   Locator{SiteID: "site", URL: "url"},
+		Locator:   Locator{SiteID: "site", URL: "http://example.com?foo=bar&x=123"},
 		Score:     10,
 		Pin:       true,
 		Deleted:   true,
@@ -77,6 +77,27 @@ func TestFormatter_FormatComment(t *testing.T) {
 	assert.Equal(t, exp, f.Format(comment))
 }
 
+func TestFormatter_FormatCommentXSSLocator(t *testing.T) {
+	comment := Comment{
+		Text:      "blah\n\nxyz",
+		User:      User{ID: "username"},
+		ParentID:  "p123",
+		ID:        "123",
+		Locator:   Locator{SiteID: "site", URL: "javascript:alert('XSS1')"},
+		Score:     10,
+		Pin:       true,
+		Deleted:   true,
+		Timestamp: time.Date(2018, 1, 1, 9, 30, 0, 0, time.Local),
+		Votes:     map[string]bool{"uu": true},
+	}
+
+	f := NewCommentFormatter(mockConverter{})
+	exp := comment
+	exp.Text = "<p>blah</p>\n\n<p>xyz</p>\n!converted"
+	exp.Locator.URL = ""
+	assert.Equal(t, exp, f.Format(comment))
+}
+
 func TestFormatter_ShortenAutoLinks(t *testing.T) {
 	f := NewCommentFormatter(nil)
 	tbl := []struct {