+12
appview/issues/issues.go
+12
appview/issues/issues.go
···
7
7
"net/http"
8
8
"slices"
9
9
"strconv"
10
+
"strings"
10
11
"time"
11
12
12
13
comatproto "github.com/bluesky-social/indigo/api/atproto"
···
21
22
"tangled.sh/tangled.sh/core/appview/notify"
22
23
"tangled.sh/tangled.sh/core/appview/oauth"
23
24
"tangled.sh/tangled.sh/core/appview/pages"
25
+
"tangled.sh/tangled.sh/core/appview/pages/markup"
24
26
"tangled.sh/tangled.sh/core/appview/pagination"
25
27
"tangled.sh/tangled.sh/core/appview/reporesolver"
26
28
"tangled.sh/tangled.sh/core/idresolver"
···
640
642
641
643
if title == "" || body == "" {
642
644
rp.pages.Notice(w, "issues", "Title and body are required")
645
+
return
646
+
}
647
+
648
+
sanitizer := markup.NewSanitizer()
649
+
if st := strings.TrimSpace(sanitizer.SanitizeDescription(title)); st == "" {
650
+
rp.pages.Notice(w, "issues", "Title is empty after HTML sanitization")
651
+
return
652
+
}
653
+
if sb := strings.TrimSpace(sanitizer.SanitizeDefault(body)); sb == "" {
654
+
rp.pages.Notice(w, "issues", "Body is empty after HTML sanitization")
643
655
return
644
656
}
645
657
+1
-1
appview/pages/templates/repo/fragments/repoDescription.html
+1
-1
appview/pages/templates/repo/fragments/repoDescription.html
···
1
1
{{ define "repo/fragments/repoDescription" }}
2
2
<span id="repo-description" class="flex flex-wrap items-center gap-2 text-sm" hx-target="this" hx-swap="outerHTML">
3
3
{{ if .RepoInfo.Description }}
4
-
{{ .RepoInfo.Description }}
4
+
{{ .RepoInfo.Description | description }}
5
5
{{ else }}
6
6
<span class="italic">this repo has no description</span>
7
7
{{ end }}
+1
-1
appview/pages/templates/repo/issues/issue.html
+1
-1
appview/pages/templates/repo/issues/issue.html
+1
-1
appview/pages/templates/repo/issues/issues.html
+1
-1
appview/pages/templates/repo/issues/issues.html
+1
-1
appview/pages/templates/repo/pulls/fragments/pullHeader.html
+1
-1
appview/pages/templates/repo/pulls/fragments/pullHeader.html
+1
-1
appview/pages/templates/repo/pulls/fragments/summarizedPullHeader.html
+1
-1
appview/pages/templates/repo/pulls/fragments/summarizedPullHeader.html
+1
-1
appview/pages/templates/repo/pulls/pull.html
+1
-1
appview/pages/templates/repo/pulls/pull.html
···
122
122
{{ end }}
123
123
</div>
124
124
<div class="flex items-center">
125
-
<span>{{ .Title }}</span>
125
+
<span>{{ .Title | description }}</span>
126
126
{{ if gt (len .Body) 0 }}
127
127
<button
128
128
class="py-1/2 px-1 mx-2 bg-gray-200 hover:bg-gray-400 rounded dark:bg-gray-700 dark:hover:bg-gray-600"
+1
-1
appview/pages/templates/repo/pulls/pulls.html
+1
-1
appview/pages/templates/repo/pulls/pulls.html
+1
-1
appview/pages/templates/user/fragments/repoCard.html
+1
-1
appview/pages/templates/user/fragments/repoCard.html
+6
appview/pulls/pulls.go
+6
appview/pulls/pulls.go
···
19
19
"tangled.sh/tangled.sh/core/appview/notify"
20
20
"tangled.sh/tangled.sh/core/appview/oauth"
21
21
"tangled.sh/tangled.sh/core/appview/pages"
22
+
"tangled.sh/tangled.sh/core/appview/pages/markup"
22
23
"tangled.sh/tangled.sh/core/appview/reporesolver"
23
24
"tangled.sh/tangled.sh/core/idresolver"
24
25
"tangled.sh/tangled.sh/core/knotclient"
···
738
739
if isPatchBased && !patchutil.IsFormatPatch(patch) {
739
740
if title == "" {
740
741
s.pages.Notice(w, "pull", "Title is required for git-diff patches.")
742
+
return
743
+
}
744
+
sanitizer := markup.NewSanitizer()
745
+
if st := strings.TrimSpace(sanitizer.SanitizeDescription(title)); (st) == "" {
746
+
s.pages.Notice(w, "pull", "Title is empty after HTML sanitization")
741
747
return
742
748
}
743
749
}