# HG changeset patch
# User nanaya <me@nanaya.pro>
# Date 1533728249 -32400
# Node ID df4be896ab8bd714eda877ef6cc905aef50f31c5
# Parent  90db232f39e792b94dcbfc45f2bd3c04d868bb0e
Improved escaping and truncating

diff -r 90db232f39e7 -r df4be896ab8b app/helpers/application_helper.rb
--- a/app/helpers/application_helper.rb	Wed Aug 08 20:19:51 2018 +0900
+++ b/app/helpers/application_helper.rb	Wed Aug 08 20:37:29 2018 +0900
@@ -1,14 +1,6 @@
 module ApplicationHelper
   include Twitter::TwitterText::Autolink
 
-  def ellipsize(text, limit = 30)
-    if text.length <= limit
-      text
-    else
-      "#{text.first(limit)}..."
-    end
-  end
-
   def atom_id(id)
     "tag:#{request.host},2005:#{id}"
   end
diff -r 90db232f39e7 -r df4be896ab8b app/views/tweets/_tweet.atom.erb
--- a/app/views/tweets/_tweet.atom.erb	Wed Aug 08 20:19:51 2018 +0900
+++ b/app/views/tweets/_tweet.atom.erb	Wed Aug 08 20:37:29 2018 +0900
@@ -3,7 +3,7 @@
   <published><%= tweet.created_at.xmlschema %></published>
   <updated><%= tweet.created_at.xmlschema %></updated>
   <link rel="alternate" type="text/html" href="<%= tweet.uri %>"/>
-  <title><%= ellipsize tweet.attrs[:full_text] %></title>
+  <title><%= truncate tweet.unescaped_text, :length => 30 %></title>
   <content type="xhtml">
     <div xmlns="http://www.w3.org/1999/xhtml">
       <%= render :partial => "tweet", :formats => :html, :locals => { :tweet => tweet } %>
diff -r 90db232f39e7 -r df4be896ab8b app/views/tweets/_tweet.html.erb
--- a/app/views/tweets/_tweet.html.erb	Wed Aug 08 20:19:51 2018 +0900
+++ b/app/views/tweets/_tweet.html.erb	Wed Aug 08 20:37:29 2018 +0900
@@ -13,11 +13,11 @@
 
   <p>
     <%# FIXME: Twitter gem doesn't support extended mode when writing this %>
-    <%= auto_link(expand_url(
-          tweet.attrs[:full_text].printable,
+    <%= auto_link(html_escape(expand_url(
+          tweet.unescaped_text,
           tweet.attrs[:entities][:urls],
           tweet.attrs[:entities][:media]
-        ))
+        )))
         .gsub("\n", "<br />")
         .html_safe
       %>
diff -r 90db232f39e7 -r df4be896ab8b config/initializers/ext_twitter_tweet.rb
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/config/initializers/ext_twitter_tweet.rb	Wed Aug 08 20:37:29 2018 +0900
@@ -0,0 +1,7 @@
+class Twitter::Tweet
+  def unescaped_text
+    CGI.unescapeHTML attrs[:full_text].printable
+  end
+
+  memoize :unescaped_text
+end