etalon 35168b9b83 fix: sanitizer double-escaped entities ( /&); dot-prefix volumes dir ...

- chat.SanitizeHTML/SanitizePlain decoded-then-escape text runs, so HTML
  entities the browser emits (e.g.   for the space after a mention chip,
  or & for a typed "&") no longer render as literal " "/"&".
  Re-escaping keeps output XSS-safe. Adds regression tests.
- Rename ./volumes -> ./.volumes so `go build/vet/test ./...` skip the mongo
  data dir (700-perm files); Makefile lint now gofmt's tracked files only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-13 12:26:32 +02:00

..

sanitize_test.go

fix: sanitizer double-escaped entities ( /&); dot-prefix volumes dir

2026-06-13 12:26:32 +02:00

sanitize.go

fix: sanitizer double-escaped entities ( /&); dot-prefix volumes dir

2026-06-13 12:26:32 +02:00