fix: sanitizer double-escaped entities ( /&); dot-prefix volumes dir

- chat.SanitizeHTML/SanitizePlain decoded-then-escape text runs, so HTML
  entities the browser emits (e.g. &nbsp; for the space after a mention chip,
  or &amp; for a typed "&") no longer render as literal "&nbsp;"/"&amp;".
  Re-escaping keeps output XSS-safe. Adds regression tests.
- Rename ./volumes -> ./.volumes so `go build/vet/test ./...` skip the mongo
  data dir (700-perm files); Makefile lint now gofmt's tracked files only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

This commit is contained in:

etalon

2026-06-13 12:26:32 +02:00

parent 0676f53280

commit 35168b9b83

5 changed files with 22 additions and 9 deletions

.gitignore

+1 -1

View File

@@ -5,4 +5,4 @@ backups/
 coverage.out
 # Docker volume data (bind-mounted under the repo; never committed)
 /volumes/
 /.volumes/

fix: sanitizer double-escaped entities (&nbsp;/&amp;); dot-prefix volumes dir

fix: sanitizer double-escaped entities ( /&); dot-prefix volumes dir