From 8b2438aebb8309c162406345a31fbfcf328f6342 Mon Sep 17 00:00:00 2001 From: "Calum H." Date: Mon, 10 Aug 2026 16:43:13 +0100 Subject: [PATCH] fix: Gifs in the project description are not working properly (#7076) * fix: Gifs in the project description are not working properly Fixes #3786 * prepr --------- Co-authored-by: Prospector <6166773+Prospector@users.noreply.github.com> --- packages/utils/parse.ts | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/packages/utils/parse.ts b/packages/utils/parse.ts index abf99a75c1..5243824b24 100644 --- a/packages/utils/parse.ts +++ b/packages/utils/parse.ts @@ -90,7 +90,7 @@ export const configuredXss = new FilterXSS({ !value.startsWith('data:') ) { try { - const url = new URL(value) + const url = new URL(value.replaceAll('&', '&')) if (url.hostname.includes('wsrv.nl')) { url.searchParams.delete('errorredirect') @@ -124,16 +124,10 @@ export const configuredXss = new FilterXSS({ !allowedHostnames.includes(url.hostname) && !allowedHostnameSuffixes.some((suffix) => url.hostname.endsWith(suffix)) ) { - return safeAttrValue( - tag, - name, - `https://wsrv.nl/?url=${encodeURIComponent( - url.toString().replaceAll('&', '&'), - )}&n=-1`, - cssFilter, - ) + const proxiedUrl = `https://wsrv.nl/?url=${encodeURIComponent(url.toString())}&n=-1` + return safeAttrValue(tag, name, proxiedUrl.replaceAll('&', '&'), cssFilter) } - return safeAttrValue(tag, name, url.toString(), cssFilter) + return safeAttrValue(tag, name, url.toString().replaceAll('&', '&'), cssFilter) } catch { /* empty */ }