Skip to content

feat: add social media feed integration with multi-platform support#299

Open
dzienisz wants to merge 1 commit intomainfrom
feat/social
Open

feat: add social media feed integration with multi-platform support#299
dzienisz wants to merge 1 commit intomainfrom
feat/social

Conversation

@dzienisz
Copy link
Copy Markdown
Collaborator

@dzienisz dzienisz commented Oct 29, 2025

  • Added configuration for Bluesky, Twitter, and LinkedIn social feed integration in .env.example
  • Created comprehensive setup documentation for each social platform (SOCIAL_FEED_SETUP.md, BLUESKY_SETUP.md)
  • Added translations for social feed UI components in English and Polish
  • Configured image domains for Mastodon instances in next.config.ts
  • Added @atproto/api dependency for Bluesky integration

@dzienisz
feat: add social media feed integration with multi-platform support
771f4f5 
- Added configuration for Bluesky, Twitter, and LinkedIn social feed integration in .env.example
- Created comprehensive setup documentation for each social platform (SOCIAL_FEED_SETUP.md, BLUESKY_SETUP.md)
- Added translations for social feed UI components in English and Polish
- Configured image domains for Mastodon instances in next.config.ts
- Added @atproto/api dependency for Bluesky integration
@vercel
Copy link
Copy Markdown

vercel Bot commented Oct 29, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
website Ready Ready Preview Comment Oct 29, 2025 1:51pm

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Oct 29, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​atproto/​api@​0.17.510010010099100

View full report

github-advanced-security[bot]
github-advanced-security AI found potential problems Oct 29, 2025
View reviewed changes
Comment thread src/lib/social.ts
Comment on lines +270 to +275
return html
.replace(/<br\s*\/?>/gi, '\n')
.replace(/<\/p>/gi, '\n\n')
.replace(/<[^>]*>/g, '')
.replace(/&nbsp;/g, ' ')
.replace(/&amp;/g, '&')

Check failure

Code scanning / CodeQL

Double escaping or unescaping High

This replacement may produce '&' characters that are double-unescaped
here
Loading
.

Copilot Autofix

AI 6 months ago

To fix the problem, we need to change the order in which HTML entities are unescaped in the stripHtml function. Specifically, the ampersand entity (&amp;) must be replaced after all other entities (&nbsp;, &lt;, &gt;, &quot;). This prevents double-unescaping, where replacing &amp; first could expose further entities that then get unescaped a second time. To implement this, edit src/lib/social.ts function stripHtml at lines 269–280, moving the .replace(/&amp;/g, '&') call after all other .replace() lines.

No additional imports or method definitions are needed, as this is a pure string manipulation.

Suggested changeset 1
src/lib/social.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/lib/social.ts b/src/lib/social.ts
--- a/src/lib/social.ts
+++ b/src/lib/social.ts
@@ -272,10 +272,10 @@
     .replace(/<\/p>/gi, '\n\n')
     .replace(/<[^>]*>/g, '')
     .replace(/&nbsp;/g, ' ')
-    .replace(/&amp;/g, '&')
     .replace(/&lt;/g, '<')
     .replace(/&gt;/g, '>')
     .replace(/&quot;/g, '"')
+    .replace(/&amp;/g, '&')
     .trim();
 }
 
EOF
@@ -272,10 +272,10 @@
.replace(/<\/p>/gi, '\n\n')
.replace(/<[^>]*>/g, '')
.replace(/&nbsp;/g, ' ')
.replace(/&amp;/g, '&')
.replace(/&lt;/g, '<')
.replace(/&gt;/g, '>')
.replace(/&quot;/g, '"')
.replace(/&amp;/g, '&')
.trim();
}

Copilot is powered by AI and may make mistakes. Always verify output.
Comment thread src/lib/social.ts
Comment on lines +270 to +273
return html
.replace(/<br\s*\/?>/gi, '\n')
.replace(/<\/p>/gi, '\n\n')
.replace(/<[^>]*>/g, '')

Check failure

Code scanning / CodeQL

Incomplete multi-character sanitization High

This string may still contain
<script
Loading
, which may cause an HTML element injection vulnerability.

Copilot Autofix

AI 6 months ago

The best way to fix the problem is to robustly sanitize the input and ensure no instances of dangerous tags (such as <script>, or angle brackets left over from incomplete tag removal) remain.

  • Preferably, use a well-known and maintained sanitization library, such as sanitize-html. This will handle complex/on-the-edge cases and keep the code maintainable and secure.
  • If not introducing a dependency, apply the regular expression replacements repeatedly (in a loop), so that if tag removal exposes further tags or unmatched brackets, those are also removed.
  • As an additional precaution, after stripping HTML tags, remove any residual < or > characters.
  • Edit only the stripHtml function in src/lib/social.ts (lines 269-280). If a library is used, import it at the top of the file.

If you are allowed to add the sanitize-html library, use that. Otherwise, as seen in the background, apply .replace() repeatedly until no changes occur, and finally remove any stray < or >.

Suggested changeset 2
src/lib/social.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/lib/social.ts b/src/lib/social.ts
--- a/src/lib/social.ts
+++ b/src/lib/social.ts
@@ -266,17 +266,18 @@
 /**
  * Strips HTML tags from text
  */
+import sanitizeHtml from 'sanitize-html';
+
 function stripHtml(html: string): string {
-  return html
-    .replace(/<br\s*\/?>/gi, '\n')
-    .replace(/<\/p>/gi, '\n\n')
-    .replace(/<[^>]*>/g, '')
-    .replace(/&nbsp;/g, ' ')
-    .replace(/&amp;/g, '&')
-    .replace(/&lt;/g, '<')
-    .replace(/&gt;/g, '>')
-    .replace(/&quot;/g, '"')
-    .trim();
+  // Remove all HTML tags and entities robustly
+  return sanitizeHtml(html, {
+    allowedTags: [], // Remove all tags
+    allowedAttributes: {},
+    textFilter: function(text) {
+      // Remove any residual < or > which might have slipped through
+      return text.replace(/[<>]/g, '');
+    }
+  }).trim();
 }
 
 /**
EOF
@@ -266,17 +266,18 @@
/**
* Strips HTML tags from text
*/
import sanitizeHtml from 'sanitize-html';

function stripHtml(html: string): string {
return html
.replace(/<br\s*\/?>/gi, '\n')
.replace(/<\/p>/gi, '\n\n')
.replace(/<[^>]*>/g, '')
.replace(/&nbsp;/g, ' ')
.replace(/&amp;/g, '&')
.replace(/&lt;/g, '<')
.replace(/&gt;/g, '>')
.replace(/&quot;/g, '"')
.trim();
// Remove all HTML tags and entities robustly
return sanitizeHtml(html, {
allowedTags: [], // Remove all tags
allowedAttributes: {},
textFilter: function(text) {
// Remove any residual < or > which might have slipped through
return text.replace(/[<>]/g, '');
}
}).trim();
}

/**
package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -88,7 +88,8 @@
     "react-icons": "^5.5.0",
     "tailwind-merge": "^2.5.2",
     "tailwindcss-animate": "^1.0.7",
-    "zod": "^3.24.2"
+    "zod": "^3.24.2",
+    "sanitize-html": "^2.17.0"
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.3.1",
EOF
@@ -88,7 +88,8 @@
"react-icons": "^5.5.0",
"tailwind-merge": "^2.5.2",
"tailwindcss-animate": "^1.0.7",
"zod": "^3.24.2"
"zod": "^3.24.2",
"sanitize-html": "^2.17.0"
},
"devDependencies": {
"@eslint/eslintrc": "^3.3.1",
This fix introduces these dependencies
Package Version Security advisories
sanitize-html (npm) 2.17.0 None
Copilot is powered by AI and may make mistakes. Always verify output.
@dzienisz dzienisz self-assigned this Oct 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@naugtur naugtur Awaiting requested review from naugtur

@fricze fricze Awaiting requested review from fricze

@Eghizio Eghizio Awaiting requested review from Eghizio

@ssynowiec ssynowiec Awaiting requested review from ssynowiec

At least 1 approving review is required to merge this pull request.

Assignees

@dzienisz dzienisz

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dzienisz @github-advanced-security