discourse/frontend/discourse-markdown-it/src
Alan Guo Xiang Tan 4f17eef310
FIX: Emoji deny list with regex metacharacters crashes cooking (#40155)
Cooking any post raises `MiniRacer::RuntimeError: SyntaxError: Invalid
regular expression: /+1/: Nothing to repeat` whenever the
`emoji_deny_list` site setting contains a name with a regex
metacharacter such as `+1` or `-1`. Every page that renders cooked
content then 500s. The names are real Unicode emoji aliases admins must
be able to deny, so validating them away is not an option.

The deny-list block in `applyEmoji` used `content.match(emoji)` which
coerces the raw emoji name into a regex via `new RegExp(...)`, and `+1`
does not compile as a regex.

This commit switches that block to literal-string `includes` and
`replaceAll` against the `:name:` token. Deny-list semantics for plain
names are unchanged: the denied emoji is still stripped from `content`
before token generation, so no `<img class="emoji">` is rendered.
2026-05-19 14:55:39 +08:00
..
features FIX: Emoji deny list with regex metacharacters crashes cooking (#40155) 2026-05-19 14:55:39 +08:00
engine.js FIX: Escape markdown characters in upload filenames (#39133) 2026-04-14 10:37:41 +02:00
index.js
options.js DEV: Stop mutating allowed_iframes for the discobot certificate (#39936) 2026-05-13 10:06:14 +01:00
setup.js DEV: Remove dropFrom parameter from deprecations (#38656) 2026-03-17 11:10:12 +00:00