@evanp/activitypub-bot 0.46.0 → 0.46.1

package/CHANGELOG.md

@@ -9,6 +9,12 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [0.46.1] - 2026-05-25
+
+### Fixed
+
+- Better escaping for Webfinger, Hashtags, and URLs in HTML output
+
 ## [0.46.0] - 2026-05-25
 
 ### Added

package/lib/microsyntax.js

@@ -26,12 +26,7 @@ export class Transformer {
   }
 
   async transform (text) {
-    let html = text
-      .replace(/&/g, '&')
-      .replace(/</g, '&lt;')
-      .replace(/>/g, '&gt;')
-      .replace(/"/g, '&quot;')
-      .replace(/'/g, '&apos;')
+    let html = this.#escape(text)
     let tag = [];
     ({ html, tag } = this.#replaceUrls(html, tag));
     ({ html, tag } = this.#replaceHashtags(html, tag));
@@ -47,7 +42,8 @@ export class Transformer {
       const segment = segments[i]
       if (this.#isLink(segment)) continue
       segments[i] = segment.replace(url, (match) => {
-        return `<a href="${match}">${match}</a>`
+        const escaped = this.#escape(match)
+        return `<a href="${escaped}">${escaped}</a>`
       })
     }
     return { html: segments.join(''), tag }
@@ -62,7 +58,9 @@ export class Transformer {
       segments[i] = segment.replace(hashtag, (match, name) => {
         const href = this.#tagNamespace + name
         tag.push({ type: AS2 + 'Hashtag', name: match, href })
-        return `<a href="${href}">${match}</a>`
+        const escaped = this.#escape(href)
+        const escapedMatch = this.#escape(match)
+        return `<a href="${escaped}">${escapedMatch}</a>`
       })
     }
     return { html: segments.join(''), tag }
@@ -78,8 +76,19 @@ export class Transformer {
       segments[i] = await this.#replaceAsync(segments[i], webfinger, async (match) => {
         const href = await self.#homePage(match.slice(1))
         if (!href) return match
-        tag.push({ type: 'Mention', name: match, href })
-        return `<a href="${href}">${match}</a>`
+        let url
+        try {
+          url = new URL(href)
+        } catch (err) {
+          return match
+        }
+        if (url.protocol !== 'https:') {
+          return match
+        }
+        tag.push({ type: 'Mention', name: match, href: url.href })
+        const escaped = this.#escape(url.href)
+        const escapedMatch = this.#escape(match)
+        return `<a href="${escaped}">${escapedMatch}</a>`
       })
     }
     return { html: segments.join(''), tag }
@@ -157,4 +166,13 @@ export class Transformer {
     // Replace the matches with their respective replacements
     return str.replace(regex, () => replacements.shift())
   }
+
+  #escape (text) {
+    return text
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&apos;')
+  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evanp/activitypub-bot",
-  "version": "0.46.0",
+  "version": "0.46.1",
   "description": "server-side ActivityPub bot framework",
   "type": "module",
   "main": "lib/index.js",