changelog | [dreamwidth/dreamwidth] 48bea6: Escape search excerpts at the SNIPPETS boundary, n...

Branch: refs/heads/main Home: https://github.com/dreamwidth/dreamwidth Commit: 48bea63e81140bb252a7b3f99d019f0bcf744b60 https://github.com/dreamwidth/dreamwidth/commit/48bea63e81140bb252a7b3f99d019f0bcf744b60 Author: Mark Smith mark@dreamwidth.org Date: 2026-05-24 (Sun, 24 May 2026)

Changed paths: M cgi-bin/DW/Search.pm

Log Message:

Escape search excerpts at the SNIPPETS boundary, not via strip_html

The previous fix leaned on LJ::strip_html to sanitize support excerpts, but strip_html is a cosmetic cleaner, not an escaper: its s/<([^<])+>//g regex only removes a <...> run with no inner '<', so a request body comment like "" loses the inner / tags but leaves the '

Move the safety boundary into snippets and LJ::ehtml the text just before CALL SNIPPETS, leaving only SNIPPETS' own highlight tags as live markup. striphtml stays purely for readability. This is the single chokepoint for both search paths, so it also closes the identical latent hole in enrichjournal, which feeds stripped-but-unescaped entry/comment/subject text to the same SNIPPETS call. No double-escaping results: the support subject/category are escaped separately and never routed through _snippets.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

To unsubscribe from these emails, change your notification settings at https://github.com/dreamwidth/dreamwidth/settings/notifications