sanitize PostTitle

backend/app/store/comment.go

@@ -128,6 +128,7 @@ func (c *Comment) Sanitize() {
 	c.User.Name = c.escapeHTMLWithSome(c.User.Name)
 	c.User.Picture = c.SanitizeAsURL(c.User.Picture)
 	c.Locator.URL = c.SanitizeAsURL(c.Locator.URL)
+	c.PostTitle = p.Sanitize(c.PostTitle)
 }
 
 // Snippet from comment's text

backend/app/store/comment_test.go

@@ -73,6 +73,10 @@ func TestComment_Sanitize(t *testing.T) {
 			out: Comment{Text: "<img src=x onerror=alert(1)>",
 				Locator: Locator{URL: "/p/2021/03/23/prep-747/#remark42__comment-1b365913-7056-4920-b9ad-01304bdda085"}},
 		},
+		{
+			inp: Comment{Text: "blah blah", PostTitle: "<script>alert()</script>something"},
+			out: Comment{Text: "blah blah", PostTitle: "something"},
+		},
 	}
 
 	for n, tt := range tbl {