From a7b44eee1a08d0767bb76b15929a804ce49b30de Mon Sep 17 00:00:00 2001 From: Umputun Date: Wed, 1 Sep 2021 13:56:06 -0500 Subject: [PATCH] sanitize PostTitle --- backend/app/store/comment.go | 1 + backend/app/store/comment_test.go | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/backend/app/store/comment.go b/backend/app/store/comment.go index 80de8bfe..091215eb 100644 --- a/backend/app/store/comment.go +++ b/backend/app/store/comment.go @@ -128,6 +128,7 @@ func (c *Comment) Sanitize() { c.User.Name = c.escapeHTMLWithSome(c.User.Name) c.User.Picture = c.SanitizeAsURL(c.User.Picture) c.Locator.URL = c.SanitizeAsURL(c.Locator.URL) + c.PostTitle = p.Sanitize(c.PostTitle) } // Snippet from comment's text diff --git a/backend/app/store/comment_test.go b/backend/app/store/comment_test.go index 4b5993b8..dd3401c9 100644 --- a/backend/app/store/comment_test.go +++ b/backend/app/store/comment_test.go @@ -73,6 +73,10 @@ func TestComment_Sanitize(t *testing.T) { out: Comment{Text: "<img src=x onerror=alert(1)>", Locator: Locator{URL: "/p/2021/03/23/prep-747/#remark42__comment-1b365913-7056-4920-b9ad-01304bdda085"}}, }, + { + inp: Comment{Text: "blah blah", PostTitle: "something"}, + out: Comment{Text: "blah blah", PostTitle: "something"}, + }, } for n, tt := range tbl {