diff --git a/backend/app/store/comment.go b/backend/app/store/comment.go index 80de8bfe..091215eb 100644 --- a/backend/app/store/comment.go +++ b/backend/app/store/comment.go @@ -128,6 +128,7 @@ func (c *Comment) Sanitize() { c.User.Name = c.escapeHTMLWithSome(c.User.Name) c.User.Picture = c.SanitizeAsURL(c.User.Picture) c.Locator.URL = c.SanitizeAsURL(c.Locator.URL) + c.PostTitle = p.Sanitize(c.PostTitle) } // Snippet from comment's text diff --git a/backend/app/store/comment_test.go b/backend/app/store/comment_test.go index 4b5993b8..dd3401c9 100644 --- a/backend/app/store/comment_test.go +++ b/backend/app/store/comment_test.go @@ -73,6 +73,10 @@ func TestComment_Sanitize(t *testing.T) { out: Comment{Text: "<img src=x onerror=alert(1)>", Locator: Locator{URL: "/p/2021/03/23/prep-747/#remark42__comment-1b365913-7056-4920-b9ad-01304bdda085"}}, }, + { + inp: Comment{Text: "blah blah", PostTitle: "something"}, + out: Comment{Text: "blah blah", PostTitle: "something"}, + }, } for n, tt := range tbl {