fix: render HTML comments properly in activity feed

Changed approach from stripping HTML on backend to rendering HTML with
sanitization on frontend, matching the pattern used in comment-display
component. This preserves HTML formatting (bold, italics, etc.) in
comment previews whilst still protecting against XSS attacks.

Backend changes:
- Reverted stripHtml() method (no longer needed)
- Keep full HTML content in commentPreview field

Frontend changes:
- Import and inject SanitizeService
- Changed from text interpolation to [innerHTML] with sanitization
- Changed <p> to <div> for comment preview container

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
2026-02-20 00:13:00 -08:00
parent 512e7eec13
commit 6ef787a3b8
2 changed files with 7 additions and 13 deletions
+4 -12
View File
@@ -224,12 +224,11 @@ export class ActivityService {
entityTitle = comment.manga.title;
}
// Strip HTML tags and get first 100 characters of comment
const plainText = this.stripHtml(comment.content);
// Get first 100 characters of comment
const commentPreview =
plainText.length > 100
? `${plainText.slice(0, 100)}...`
: plainText;
comment.content.length > 100
? `${comment.content.slice(0, 100)}...`
: comment.content;
return {
id: `comment-${comment.id}`,
@@ -351,11 +350,4 @@ export class ActivityService {
return "Unknown Item";
}
}
/**
* Strip HTML tags from content for plain text preview.
*/
private stripHtml(html: string): string {
return html.replace(/<[^>]*>/g, "").trim();
}
}