fix: chat accepts quotes now

internal/service/chat_service_test.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -1719,3 +1720,49 @@ func TestOpenDMByHandle(t *testing.T) {
 		t.Errorf("unknown handle: err = %v, want ErrUserGone", err)
 	}
 }
+
+// A quote renders as trusted in-app content, so its link must be unable to
+// leave the app. Anything that could navigate off-site has to be refused.
+func TestQuoteAttachment_RejectsOffSitePaths(t *testing.T) {
+	good := []string{
+		"/books/bg/2/13",
+		"/books/bg/2/13?hl=abc%20def",
+		"/u/someone/posts#post-1",
+		"/",
+	}
+	for _, p := range good {
+		q := QuoteAttachment{Path: p, Title: "Bg 2.13", Text: "the passage"}
+		if !q.valid() {
+			t.Errorf("valid() = false for in-app path %q", p)
+		}
+	}
+
+	bad := map[string]string{
+		"absolute http":      "http://evil.example/x",
+		"absolute https":     "https://evil.example/x",
+		"protocol relative":  "//evil.example/x",
+		"backslash relative": "/\\evil.example/x",
+		"scheme only":        "javascript:alert(1)",
+		"data uri":           "data:text/html,<script>",
+		"no leading slash":   "books/bg/2/13",
+		"empty":              "",
+		"newline injection":  "/books\n/evil",
+		"tab injection":      "/books\t/evil",
+	}
+	for name, p := range bad {
+		q := QuoteAttachment{Path: p, Title: "Bg 2.13", Text: "the passage"}
+		if q.valid() {
+			t.Errorf("%s: valid() = true for %q — must be refused", name, p)
+		}
+	}
+
+	// A quote with no passage is not a quote.
+	if (&QuoteAttachment{Path: "/books/bg/2/13", Text: "   "}).valid() {
+		t.Error("valid() = true for a blank passage")
+	}
+	// Oversized fields are refused rather than truncated.
+	long := strings.Repeat("x", maxQuoteTextRunes+1)
+	if (&QuoteAttachment{Path: "/books/bg/2/13", Text: long}).valid() {
+		t.Error("valid() = true for an oversized passage")
+	}
+}