From fd75f3116aa30eb4958cc747f944f202ec69a484 Mon Sep 17 00:00:00 2001
From: Osmium Sorcerer <os@sof.beauty>
Date: Wed, 3 Jun 2026 11:23:33 +0000
Subject: Remove safeTags, decodeChat, and prepChat

Following the removal of innerHTML manipulation, we no longer need these
sanitization functions.

I've reviewed every safeTags call site to make sure the outputs don't
end up anywhere unsafe, and malicious input can't malipulate DOM or
execute code. These values either end up either as plain text
(textContent, innerText, createTextNode, title, option) or as a URL
path to request assets to the server (encoded using encodeURI).

That is, if safeTags was even effective, considering all that function
did was replace '<' and '>' symbols with Unicode lookalikes. Even the
comment was suggesting the use of fundamentally safer functions instead
of these hacks.

Replace remaining uses of prepChat with unescapeChat as we still need
to do the token substitution (like "<and>" to "&"). decodeChat was
escaping Unicode sequences like \uXXXX, but I don't see the reason for
this, AO2 Client doesn't have this feature, and considering WebSocket
text frames are strictly UTF-8, we don't need these encodings.
---
 webAO/__tests__/encoding.test.ts | 39 +--------------------------------------
 1 file changed, 1 insertion(+), 38 deletions(-)

(limited to 'webAO/__tests__/encoding.test.ts')

diff --git a/webAO/__tests__/encoding.test.ts b/webAO/__tests__/encoding.test.ts
index 36f34cfc..aa1409a9 100644
--- a/webAO/__tests__/encoding.test.ts
+++ b/webAO/__tests__/encoding.test.ts
@@ -1,4 +1,4 @@
-import { escapeChat, unescapeChat, safeTags, decodeChat, prepChat } from '../encoding';
+import { escapeChat, unescapeChat } from '../encoding';
 
 describe('encode/decode', () => {
   it('should escape special characters correctly', () => {
@@ -13,40 +13,3 @@ describe('encode/decode', () => {
     expect(unescapeChat(input)).toBe(expectedOutput);
   });
 });
-
-describe('safeTags', () => {
-  it('should replace < with ＜ and > with ＞', () => {
-    const input = '<div>Hello</div>';
-    const expectedOutput = '＜div＞Hello＜/div＞';
-    expect(safeTags(input)).toBe(expectedOutput);
-  });
-
-  it('should handle empty strings correctly', () => {
-    expect(safeTags('')).toBe('');
-  });
-});
-
-describe('decodeChat', () => {
-  it('should decode escaped unicode characters', () => {
-    const input = '\\u0041\\u0026\\u003F';
-    const expectedOutput = 'A&?';
-    expect(decodeChat(input)).toBe(expectedOutput);
-  });
-
-  it('should handle no unicode to decode', () => {
-    const input = 'Hello World!';
-    expect(decodeChat(input)).toBe(input);
-  });
-});
-
-describe('prepChat', () => {
-  it('should apply safeTags, unescapeChat and decodeChat correctly', () => {
-    const input = '<num><and>A<percent>';
-    const expectedOutput = '#&A%'; // Output after applying all functions in order
-    expect(prepChat(input)).toBe(expectedOutput);
-  });
-
-  it('should handle empty strings correctly', () => {
-    expect(prepChat('')).toBe('');
-  });
-});
\ No newline at end of file
-- 
cgit