fix: sanitizer double-escaped entities ( /&); dot-prefix volumes dir

- chat.SanitizeHTML/SanitizePlain decoded-then-escape text runs, so HTML entities the browser emits (e.g.   for the space after a mention chip, or & for a typed "&") no longer render as literal " "/"&". Re-escaping keeps output XSS-safe. Adds regression tests. - Rename ./volumes -> ./.volumes so `go build/vet/test ./...` skip the mongo data dir (700-perm files); Makefile lint now gofmt's tracked files only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-13 12:26:32 +02:00
parent 0676f53280
commit 35168b9b83
5 changed files with 22 additions and 9 deletions
@@ -12,6 +12,10 @@ func TestSanitizeHTML(t *testing.T) {
 		want string
 	}{
 		{"plain text escaped", `hello <world> & "friends"`, "hello  &amp; &#34;friends&#34;"},
+		{"existing entity not double-escaped", `a &amp; b &lt;ok&gt;`, "a &amp; b &lt;ok&gt;"},
+		{"mention span kept with sanitized uid", `<span class="mention" data-user-card="01ABCdef">@Jane Doe</span> hi`,
+			`<span class="mention" data-user-card="01ABCdef">@Jane Doe</span> hi`},
+		{"non-mention span dropped", `<span style="x">keep text</span>`, "keep text"},
 		{"allowed formatting kept", "<b>bold</b> <i>it</i> <u>u</u> <s>s</s>", "<b>bold</b> <i>it</i> <u>u</u> <s>s</s>"},
 		{"paragraph and lists", "<p>a</p><ul><li>x</li><li>y</li></ul>", "<p>a</p><ul><li>x</li><li>y</li></ul>"},
 		{"code and pre", "<pre><code>x := 1</code></pre>", "<pre><code>x := 1</code></pre>"},