fix: strip HTML tags from derived excerpt

gsub(/<[^>]+>/, '') before stripping markdown markup, so auto-generated excerpts don't leak raw HTML from post bodies.
2026-06-25 22:06:49 +02:00
parent 4597c685da
commit d26d3b5a5b
3 changed files with 11 additions and 1 deletions
@@ -112,7 +112,7 @@ module Volumen
                      .find { |para| !para.empty? && !para.start_with?("#") }
      return "" if paragraph.nil?

-      stripped = paragraph.gsub(/[*_`>#]/, "").strip
+      stripped = paragraph.gsub(/<[^>]+>/, "").gsub(/[*_`>#]/, "").strip
      stripped.length > limit ? "#{stripped[0, limit].rstrip}…" : stripped
    end
  end