etalon/BountyBoard
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: sanitizer double-escaped entities ( /&); dot-prefix volumes dir

Browse Source 
- chat.SanitizeHTML/SanitizePlain decoded-then-escape text runs, so HTML
  entities the browser emits (e.g.   for the space after a mention chip,
  or & for a typed "&") no longer render as literal " "/"&".
  Re-escaping keeps output XSS-safe. Adds regression tests.
- Rename ./volumes -> ./.volumes so `go build/vet/test ./...` skip the mongo
  data dir (700-perm files); Makefile lint now gofmt's tracked files only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
etalon
2026-06-13 12:26:32 +02:00
parent 0676f53280
commit 35168b9b83
5 changed files with 22 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/chat/sanitize.go
+13 -4
View File
@@ -31,10 +31,10 @@ func SanitizeHTML(in string) string {
if c != '<' {
j := strings.IndexByte(in[i:], '<')
if j < 0 {
out.WriteString(html.EscapeString(in[i:]))
out.WriteString(escapeText(in[i:]))
break
}
out.WriteString(html.EscapeString(in[i : i+j]))
out.WriteString(escapeText(in[i : i+j]))
i += j
continue
}
@@ -118,6 +118,15 @@ func SanitizeHTML(in string) string {
return out.String()
}
// escapeText normalizes a text run from (possibly entity-encoded) input HTML:
// decode existing entities, then re-escape. This keeps a single round of
// escaping so entities the browser emits — e.g. &nbsp; for spaces around inline
// elements, or &amp; for a typed "&" — don't get double-escaped into visible
// "&nbsp;"/"&amp;" text. Re-escaping keeps the output XSS-safe.
func escapeText(s string) string {
return html.EscapeString(html.UnescapeString(s))
}
// splitTag separates the tag name from its raw attribute string.
func splitTag(raw string) (string, string) {
for i := 0; i < len(raw); i++ {
@@ -219,10 +228,10 @@ func SanitizePlain(in string) string {
if in[i] != '<' {
j := strings.IndexByte(in[i:], '<')
if j < 0 {
out.WriteString(html.EscapeString(in[i:]))
out.WriteString(escapeText(in[i:]))
break
}
out.WriteString(html.EscapeString(in[i : i+j]))
out.WriteString(escapeText(in[i : i+j]))
i += j
continue
}
internal/chat/sanitize_test.go
+4
View File
@@ -12,6 +12,10 @@ func TestSanitizeHTML(t *testing.T) {
want string
}{
{"plain text escaped", `hello <world> & "friends"`, "hello &amp; &#34;friends&#34;"},
{"existing entity not double-escaped", `a &amp; b &lt;ok&gt;`, "a &amp; b &lt;ok&gt;"},
{"mention span kept with sanitized uid", `<span class="mention" data-user-card="01ABCdef">@Jane Doe</span> hi`,
`<span class="mention" data-user-card="01ABCdef">@Jane Doe</span> hi`},
{"non-mention span dropped", `<span style="x">keep text</span>`, "keep text"},
{"allowed formatting kept", "<b>bold</b> <i>it</i> <u>u</u> <s>s</s>", "<b>bold</b> <i>it</i> <u>u</u> <s>s</s>"},
{"paragraph and lists", "<p>a</p><ul><li>x</li><li>y</li></ul>", "<p>a</p><ul><li>x</li><li>y</li></ul>"},
{"code and pre", "<pre><code>x := 1</code></pre>", "<pre><code>x := 1</code></pre>"},