+12

appview/issues/issues.go

··· 7 7 "net/http" 8 8 "slices" 9 9 "strconv" 10 10 + "strings" 10 11 "time" 11 12 12 13 comatproto "github.com/bluesky-social/indigo/api/atproto" ··· 20 21 "tangled.sh/tangled.sh/core/appview/notify" 21 22 "tangled.sh/tangled.sh/core/appview/oauth" 22 23 "tangled.sh/tangled.sh/core/appview/pages" 24 24 + "tangled.sh/tangled.sh/core/appview/pages/markup" 23 25 "tangled.sh/tangled.sh/core/appview/pagination" 24 26 "tangled.sh/tangled.sh/core/appview/reporesolver" 25 27 "tangled.sh/tangled.sh/core/idresolver" ··· 639 641 640 642 if title == "" || body == "" { 641 643 rp.pages.Notice(w, "issues", "Title and body are required") 644 644 + return 645 645 + } 646 646 + 647 647 + sanitizer := markup.NewSanitizer() 648 648 + if st := strings.TrimSpace(sanitizer.SanitizeDescription(title)); st == "" { 649 649 + rp.pages.Notice(w, "issues", "Title is empty after HTML sanitization") 650 650 + return 651 651 + } 652 652 + if sb := strings.TrimSpace(sanitizer.SanitizeDefault(body)); sb == "" { 653 653 + rp.pages.Notice(w, "issues", "Body is empty after HTML sanitization") 642 654 return 643 655 } 644 656

+1 -1

appview/pages/templates/repo/fragments/repoDescription.html

··· 1 1 {{ define "repo/fragments/repoDescription" }} 2 2 <span id="repo-description" class="flex flex-wrap items-center gap-2 text-sm" hx-target="this" hx-swap="outerHTML"> 3 3 {{ if .RepoInfo.Description }} 4 4 - {{ .RepoInfo.Description }} 4 4 + {{ .RepoInfo.Description | description }} 5 5 {{ else }} 6 6 <span class="italic">this repo has no description</span> 7 7 {{ end }}

+1 -1

appview/pages/templates/repo/issues/issue.html

··· 11 11 {{ define "repoContent" }} 12 12 <header class="pb-4"> 13 13 <h1 class="text-2xl"> 14 14 - {{ .Issue.Title }} 14 14 + {{ .Issue.Title | description }} 15 15 <span class="text-gray-500 dark:text-gray-400">#{{ .Issue.IssueId }}</span> 16 16 </h1> 17 17 </header>

+1 -1

appview/pages/templates/repo/issues/issues.html

··· 45 45 href="/{{ $.RepoInfo.FullName }}/issues/{{ .IssueId }}" 46 46 class="no-underline hover:underline" 47 47 > 48 48 - {{ .Title }} 48 48 + {{ .Title | description }} 49 49 <span class="text-gray-500">#{{ .IssueId }}</span> 50 50 </a> 51 51 </div>

+1 -1

appview/pages/templates/repo/pulls/fragments/pullHeader.html

··· 1 1 {{ define "repo/pulls/fragments/pullHeader" }} 2 2 <header class="pb-4"> 3 3 <h1 class="text-2xl dark:text-white"> 4 4 - {{ .Pull.Title }} 4 4 + {{ .Pull.Title | description }} 5 5 <span class="text-gray-500 dark:text-gray-400">#{{ .Pull.PullId }}</span> 6 6 </h1> 7 7 </header>

+1 -1

appview/pages/templates/repo/pulls/fragments/summarizedPullHeader.html

··· 9 9 </div> 10 10 <span class="truncate text-sm text-gray-800 dark:text-gray-200"> 11 11 <span class="text-gray-500 dark:text-gray-400">#{{ .PullId }}</span> 12 12 - {{ .Title }} 12 12 + {{ .Title | description }} 13 13 </span> 14 14 </div> 15 15

+1 -1

appview/pages/templates/repo/pulls/pull.html

··· 122 122 {{ end }} 123 123 </div> 124 124 <div class="flex items-center"> 125 125 - <span>{{ .Title }}</span> 125 125 + <span>{{ .Title | description }}</span> 126 126 {{ if gt (len .Body) 0 }} 127 127 <button 128 128 class="py-1/2 px-1 mx-2 bg-gray-200 hover:bg-gray-400 rounded dark:bg-gray-700 dark:hover:bg-gray-600"

+1 -1

appview/pages/templates/repo/pulls/pulls.html

··· 50 50 <div class="px-6 py-4 z-5"> 51 51 <div class="pb-2"> 52 52 <a href="/{{ $.RepoInfo.FullName }}/pulls/{{ .PullId }}" class="dark:text-white"> 53 53 - {{ .Title }} 53 53 + {{ .Title | description }} 54 54 <span class="text-gray-500 dark:text-gray-400">#{{ .PullId }}</span> 55 55 </a> 56 56 </div>

+1 -1

appview/pages/templates/user/fragments/repoCard.html

··· 21 21 </div> 22 22 {{ with .Description }} 23 23 <div class="text-gray-600 dark:text-gray-300 text-sm"> 24 24 - {{ . }} 24 24 + {{ . | description }} 25 25 </div> 26 26 {{ end }} 27 27

+6

appview/pulls/pulls.go

··· 19 19 "tangled.sh/tangled.sh/core/appview/notify" 20 20 "tangled.sh/tangled.sh/core/appview/oauth" 21 21 "tangled.sh/tangled.sh/core/appview/pages" 22 22 + "tangled.sh/tangled.sh/core/appview/pages/markup" 22 23 "tangled.sh/tangled.sh/core/appview/reporesolver" 23 24 "tangled.sh/tangled.sh/core/idresolver" 24 25 "tangled.sh/tangled.sh/core/knotclient" ··· 737 738 if isPatchBased && !patchutil.IsFormatPatch(patch) { 738 739 if title == "" { 739 740 s.pages.Notice(w, "pull", "Title is required for git-diff patches.") 741 741 + return 742 742 + } 743 743 + sanitizer := markup.NewSanitizer() 744 744 + if st := strings.TrimSpace(sanitizer.SanitizeDescription(title)); (st) == "" { 745 745 + s.pages.Notice(w, "pull", "Title is empty after HTML sanitization") 740 746 return 741 747 } 742 748 }