Skip to content

fix: allow marquee in inbox message sanitizer #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
DJAscendance wants to merge 1 commit into from
Closed

fix: allow marquee in inbox message sanitizer #12

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions api/src/services/inbox/inbox.service.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,7 @@ export class InboxService {
'hr',
'li',
'main',
'marquee',
'ol',
'p',
Comment on lines 108 to 112

@DJAscendance DJAscendance Aug 19, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right, and it goes further than a duplicate: the premise of this PR is wrong.

I verified against origin/master. allowedTags already contained 'marquee' at line 128, sorted alphabetically between 'mark' and 'q', so the inbox has always permitted the tag. Running the original config through sanitize-html confirms it: <marquee width="400" direction="left">hi</marquee> passes through unchanged.

Comparing the two tag lists on master, board and inbox are already identical: 76 entries each, same pre-existing 'main' duplicate, nothing present in one and absent from the other. There was no parity bug to fix.

My error was diagnosing from a truncated view of the array. I read the head and tail of the list, saw marquee in allowedAttributes, and inferred it was missing from allowedTags without checking the middle.

Closing this PR rather than fixing the duplicate, since the change is not needed at all. Thanks for the catch.

'pre',
Expand Down