From 4b3e5133b027bdbb3da086ed320a229707ffb815 Mon Sep 17 00:00:00 2001
From: Bianca Nenciu <nbianca@users.noreply.github.com>
Date: Mon, 7 Nov 2022 16:22:35 +0200
Subject: [PATCH] FIX: Correctly render link title in draft preview (#18906)

The additional unescaping could cause link titles to be rendered
incorrectly.
---
 .../javascripts/discourse/app/lib/text.js     |  1 -
 .../discourse/tests/unit/lib/text-test.js     | 25 ++++++++++++++++++-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/app/assets/javascripts/discourse/app/lib/text.js b/app/assets/javascripts/discourse/app/lib/text.js
index 623e1652461..f87aca89a40 100644
--- a/app/assets/javascripts/discourse/app/lib/text.js
+++ b/app/assets/javascripts/discourse/app/lib/text.js
@@ -157,7 +157,6 @@ export function excerpt(cooked, length) {
         resultLength += element.textContent.length;
       }
     } else if (element.tagName === "A") {
-      element.innerHTML = element.innerText;
       result += element.outerHTML;
       resultLength += element.innerText.length;
     } else if (element.tagName === "IMG") {
diff --git a/app/assets/javascripts/discourse/tests/unit/lib/text-test.js b/app/assets/javascripts/discourse/tests/unit/lib/text-test.js
index 699effbe537..b78b2de6890 100644
--- a/app/assets/javascripts/discourse/tests/unit/lib/text-test.js
+++ b/app/assets/javascripts/discourse/tests/unit/lib/text-test.js
@@ -1,5 +1,5 @@
 import { module, test } from "qunit";
-import { parseAsync } from "discourse/lib/text";
+import { cookAsync, excerpt, parseAsync } from "discourse/lib/text";
 
 module("Unit | Utility | text", function () {
   test("parseAsync", async function (assert) {
@@ -11,4 +11,27 @@ module("Unit | Utility | text", function () {
       );
     });
   });
+
+  test("excerpt", async function (assert) {
+    let cooked = await cookAsync("Hello! :wave:");
+    assert.strictEqual(
+      await excerpt(cooked, 300),
+      'Hello! <img src="/images/emoji/google_classic/wave.png?v=12" title=":wave:" class="emoji" alt=":wave:" loading="lazy" width="20" height="20">'
+    );
+
+    cooked = await cookAsync("[:wave:](https://example.com)");
+    assert.strictEqual(
+      await excerpt(cooked, 300),
+      '<a href="https://example.com"><img src="/images/emoji/google_classic/wave.png?v=12" title=":wave:" class="emoji only-emoji" alt=":wave:" loading="lazy" width="20" height="20"></a>'
+    );
+
+    cooked = await cookAsync('<script>alert("hi")</script>');
+    assert.strictEqual(await excerpt(cooked, 300), "");
+
+    cooked = await cookAsync("[`<script>alert('hi')</script>`]()");
+    assert.strictEqual(
+      await excerpt(cooked, 300),
+      "<a><code>&lt;script&gt;alert('hi')&lt;/script&gt;</code></a>"
+    );
+  });
 });