feat: convert URLs to clickable links in event descriptions

- Add convert_urls_to_links utility function with regex URL detection
- Apply URL conversion to full event descriptions in both individual and list views
- Keep short descriptions as plain text for better readability in list views
- Add proper HTML escaping and security attributes (target="_blank", rel="noopener noreferrer")

Cargo.toml

···
 chrono = { version = "0.4", default-features = false, features = ["std", "alloc", "now", "serde"] }
 futures-util = { version = "0.3", features = ["sink"] }
 headers = "0.4"
+html-escape = "0.2"
 http = "1.1"
+regex = "1.10"
 serde_json = { version = "1.0", features = ["alloc"] }
 serde = { version = "1.0", features = ["alloc", "derive"] }
 thiserror = "2.0"
···
 metrohash = "1.0.7"
 fluent-templates = { version = "0.13.0", features = ["handlebars"] }
 serde_urlencoded = "0.7.1"
-ics = "0.5.8"
+ics = "0.5"
 
 [profile.release]
 opt-level = 3

src/http/handle_filter_events.rs

···
 use crate::http::errors::{CommonError, WebError};
 use crate::http::middleware_filter::{FilterCriteriaExtension, FilterQueryParams};
 use crate::http::pagination::PaginationView;
+use crate::http::utils::convert_urls_to_links;
 use crate::storage::{StoragePool, event::{get_user_rsvp, extract_event_details}};
 
 /// Template-compatible event data with flattened structure
···
         collection, // Set collection for legacy detection
         
         name: event_details.name.to_string(),
-        description: Some(event_details.description.to_string()).filter(|s| !s.is_empty()),
+        description: Some(event_details.description.to_string()).filter(|s| !s.is_empty()).map(|desc| convert_urls_to_links(&desc)),
         description_short: Some(event_details.description.to_string()).filter(|s| !s.is_empty()).map(|desc| {
-            // Truncate description for short version
+            // Truncate description for short version, but don't convert URLs to links
             if desc.len() > 200 {
                 format!("{}...", &desc[..200])
             } else {
···
     // Use EventView data if available for better formatting (overrides the basic data)
     if let Some(ref event_view) = hydrated.event_view {
         template_event.name = event_view.name.clone();
-        template_event.description = event_view.description.clone();
+        template_event.description = event_view.description.as_ref().map(|desc| convert_urls_to_links(desc));
         template_event.description_short = event_view.description_short.clone();
         template_event.organizer_display_name = event_view.organizer_display_name.clone();
         template_event.starts_at_machine = event_view.starts_at_machine.clone();

src/http/handle_view_event.rs

···
 use crate::http::event_view::EventView;
 use crate::http::pagination::Pagination;
 use crate::http::tab_selector::TabSelector;
-use crate::http::utils::url_from_aturi;
+use crate::http::utils::{convert_urls_to_links, url_from_aturi};
 use crate::resolve::parse_input;
 use crate::resolve::InputType;
 use crate::storage::event::count_event_rsvps;
···
     event_with_counts.count_going = going_count;
     event_with_counts.count_interested = interested_count;
     event_with_counts.count_notgoing = notgoing_count;
+
+    // Convert URLs to clickable links in event descriptions
+    if let Some(ref mut description) = event_with_counts.description {
+        *description = convert_urls_to_links(description);
+    }
+    if let Some(ref mut description_short) = event_with_counts.description_short {
+        *description_short = convert_urls_to_links(description_short);
+    }
 
     Ok(renderer.render_template(
             "view_event",

src/http/utils.rs

···
     },
     http::errors::UrlError,
 };
+use regex::Regex;
+use std::sync::LazyLock;
 
 pub type QueryParam<'a> = (&'a str, &'a str);
 pub type QueryParams<'a> = Vec<QueryParam<'a>>;
···
         trimmed.to_string()
     }
 }
+
+/// Regular expression for matching URLs
+static URL_REGEX: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r"https?://[^\s<>\[\]{}|\\^`]+").expect("Failed to compile URL regex")
+});
+
+/// Convert URLs in text to clickable HTML links while escaping other HTML content
+///
+/// This function finds URLs in the input text and converts them to clickable anchor tags
+/// while properly escaping any other HTML content to prevent XSS attacks.
+///
+/// # Arguments
+/// * `text` - The input text that may contain URLs
+///
+/// # Returns
+/// * A string with URLs converted to HTML anchor tags and other content HTML-escaped
+pub fn convert_urls_to_links(text: &str) -> String {
+    tracing::debug!("convert_urls_to_links called with text: {}", text);
+    
+    let mut result = String::new();
+    let mut last_end = 0;
+
+    for url_match in URL_REGEX.find_iter(text) {
+        // Add the text before this URL (HTML escaped)
+        let before_url = &text[last_end..url_match.start()];
+        result.push_str(&html_escape::encode_text(before_url));
+        
+        // Add the URL as a clickable link
+        let url = url_match.as_str();
+        let href = if url.starts_with("http://") || url.starts_with("https://") {
+            url.to_string()
+        } else {
+            format!("https://{}", url)
+        };
+        
+        result.push_str(&format!(
+            r#"<a href="{}" target="_blank" rel="noopener noreferrer">{}</a>"#,
+            html_escape::encode_quoted_attribute(&href),
+            html_escape::encode_text(url)
+        ));
+        
+        last_end = url_match.end();
+    }
+
+    // Add any remaining text after the last URL (HTML escaped)
+    let remaining = &text[last_end..];
+    result.push_str(&html_escape::encode_text(remaining));
+    
+    tracing::debug!("convert_urls_to_links result: {}", result);
+    result
+}