sanitize Title on find level as well

backend/app/store/comment.go

@@ -172,3 +172,8 @@ func (c *Comment) escapeHTMLWithSome(inp string) string {
 	res = strings.Replace(res, "&", "&", -1)
 	return res
 }
+
+// SanitizeText used to sanitize any input string
+func (c *Comment) SanitizeText(inp string) string {
+	return c.escapeHTMLWithSome(bluemonday.UGCPolicy().Sanitize(inp))
+}

backend/app/store/comment_test.go

@@ -224,5 +224,37 @@ func TestComment_sanitizeAsURL(t *testing.T) {
 			assert.Equal(t, tt.out, c.SanitizeAsURL(tt.inp))
 		})
 	}
+}
+
+func TestComment_sanitizeText(t *testing.T) {
+
+	tbl := []struct {
+		inp, out string
+	}{
+		{
+			"/p/2021/03/23/prep-747/#remark42__comment-1b365913-7056-4920-b9ad-01304bdda085",
+			"/p/2021/03/23/prep-747/#remark42__comment-1b365913-7056-4920-b9ad-01304bdda085",
+		},
+		{
+			"https://radio-t.com/p/2021/03/23/prep-747/#remark42__comment-1b365913-7056-4920-b9ad-01304bdda085",
+			"https://radio-t.com/p/2021/03/23/prep-747/#remark42__comment-1b365913-7056-4920-b9ad-01304bdda085",
+		},
+		{
+			"<script>alert()</script>something",
+			"something",
+		},
+		{
+			"<a href=javascript:alert(document.domain)//>xxx</a>",
+			"&lt;a/&gt;xxx&lt;/a&gt;",
+		},
+	}
+
+	for i, tt := range tbl {
+		tt := tt
+		c := Comment{}
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			assert.Equal(t, tt.out, c.SanitizeText(tt.inp))
+		})
+	}
 
 }

backend/app/store/service/service.go

@@ -966,6 +966,7 @@ func (s *DataStore) alterComment(c store.Comment, user store.User) (res store.Co
 
 	c = s.prepVotes(c, user)
 	c.Locator.URL = c.SanitizeAsURL(c.Locator.URL) // urls prior to #927
+	c.PostTitle = c.SanitizeText(c.PostTitle)
 	return c
 }
 

backend/app/store/service/service_test.go

@@ -1095,6 +1095,7 @@ func TestService_Find(t *testing.T) {
 		User:      store.User{ID: "user1", Name: "user name"},
 		Score:     1,
 		Votes:     map[string]bool{"id-1": true, "id-2": true, "123456": false},
+		PostTitle: `some title, <a href="http://radio-t.com">link</a>`,
 	}
 	_, err = b.Engine.Create(comment) // create directly with engine, doesn't set Controversy
 	assert.NoError(t, err)
@@ -1107,6 +1108,9 @@ func TestService_Find(t *testing.T) {
 	assert.InDelta(t, 1.73, res[0].Controversy, 0.01)
 	assert.Equal(t, "id-1", res[1].ID)
 	assert.InDelta(t, 0, res[1].Controversy, 0.01)
+
+	// make sure title sanitized
+	assert.Equal(t, "some title, &lt;a href=\\\"http://radio-t.com\\\" rel=\\\"nofollow\\\"&gt;link&lt;/a&gt;", res[0].PostTitle)
 }
 
 func TestService_FindSince(t *testing.T) {