sanitize on preview

app/rest/api/rest.go

@@ -164,6 +164,8 @@ func (s *Rest) previewCommentCtrl(w http.ResponseWriter, r *http.Request) {
 		rest.SendErrorJSON(w, r, http.StatusBadRequest, err, "can't bind comment")
 		return
 	}
+
+	comment.Sanitize()
 	comment.Text = string(blackfriday.Run([]byte(comment.Text), blackfriday.WithExtensions(mdExt)))
 	render.HTML(w, r, comment.Text)
 }

app/store/comment.go

@@ -84,8 +84,8 @@ func (c *Comment) SetDeleted() {
 	c.Deleted = true
 }
 
-// sanitize clean dangerous html/js from the comment
-func (c *Comment) sanitize() {
+// Sanitize clean dangerous html/js from the comment
+func (c *Comment) Sanitize() {
 	p := bluemonday.UGCPolicy()
 	c.Text = p.Sanitize(c.Text)
 	c.User.ID = template.HTMLEscapeString(c.User.ID)

app/store/comment_test.go

@@ -27,7 +27,7 @@ func TestComment_Sanitize(t *testing.T) {
 	}
 
 	for n, tt := range tbl {
-		tt.inp.sanitize()
+		tt.inp.Sanitize()
 		assert.Equal(t, tt.out, tt.inp, "check #%d", n)
 	}
 }

app/store/service.go

@@ -28,7 +28,7 @@ func (s *Service) Create(comment Comment) (commentID string, err error) {
 		comment.Votes = make(map[string]bool)
 	}
 
-	comment.sanitize()            // clear potentially dangerous js from all parts of comment
+	comment.Sanitize()            // clear potentially dangerous js from all parts of comment
 	comment.User.hashIP(s.Secret) // replace ip by hash
 
 	return s.Interface.Create(comment)
@@ -100,7 +100,7 @@ func (s *Service) EditComment(locator Locator, commentID string, text string, ed
 	comment.Text = text
 	comment.Edit = &edit
 	comment.Edit.Timestamp = time.Now()
-	comment.sanitize()
+	comment.Sanitize()
 	err = s.Put(locator, comment)
 	return comment, err
 }