From f28c61a373847f98e4f0c1ed58205f1908767ad9 Mon Sep 17 00:00:00 2001
From: Joep Meindertsma <joep@ontola.io>
Date: Thu, 10 Sep 2026 14:10:05 +0200
Subject: [PATCH] Render a supplier's plain agenda text as markdown, so its
 links are links

Notubiz hands over HTML for meeting and agenda descriptions; iBabs hands
over plain text that griffies write with markdown in it. Both were
inserted as HTML, so Harderwijk's "[www.harderwijk.nl/vergaderingen](...)"
appeared with its brackets and unclickable, with &#xD; entities in
between (#295). Text without the tags a supplier's HTML uses is now
decoded, escaped and rendered as markdown: links become links, line
breaks survive, and nothing in it can become markup of its own. HTML is
passed through as before.
---
 tests/markdown.test.ts           | 32 ++++++++++++++++++++++++++++
 web/src/MeetingAgendaTree.svelte |  4 ++--
 web/src/markdown.ts              | 36 ++++++++++++++++++++++++++++++++
 3 files changed, 70 insertions(+), 2 deletions(-)
 create mode 100644 tests/markdown.test.ts

diff --git a/tests/markdown.test.ts b/tests/markdown.test.ts
new file mode 100644
index 0000000..21a2404
--- /dev/null
+++ b/tests/markdown.test.ts
@@ -0,0 +1,32 @@
+import { renderSupplierText } from "../web/src/markdown.ts";
+
+function assert(condition: unknown, message: string): asserts condition {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+Deno.test("plain supplier text with markdown links becomes clickable, and safe", () => {
+  // #295: Harderwijk's agenda text, as iBabs delivers it.
+  const html = renderSupplierText(
+    "De vergadering is te volgen via [www.harderwijk.nl/vergaderingen](https://www.harderwijk.nl/vergaderingen).&#xD;\n&#xD;\nProces: <script>alert(1)</script> is geen markup.",
+  );
+  assert(
+    html.includes(
+      '<a href="https://www.harderwijk.nl/vergaderingen">www.harderwijk.nl/vergaderingen</a>',
+    ),
+    `the markdown link is rendered, got ${html}`,
+  );
+  assert(!html.includes("&#xD;") && !html.includes("\r"), "carriage-return entities are dropped");
+  assert(!html.includes("<script>"), "angle brackets in supplier text never become tags");
+  assert(html.includes("&lt;script&gt;"), "they are shown as text instead");
+});
+
+Deno.test("supplier HTML is passed through as before", () => {
+  const html = "<p>Vergadering in de <b>raadzaal</b>.</p>";
+  assert(renderSupplierText(html) === html, "HTML from Notubiz keeps its markup");
+  assert(
+    renderSupplierText("") === "" && renderSupplierText(undefined) === "",
+    "empty stays empty",
+  );
+});
diff --git a/web/src/MeetingAgendaTree.svelte b/web/src/MeetingAgendaTree.svelte
index 21811bd..6749d48 100644
--- a/web/src/MeetingAgendaTree.svelte
+++ b/web/src/MeetingAgendaTree.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-  import { renderDocumentMarkdown } from "./markdown.ts";
+  import { renderDocumentMarkdown, renderSupplierText } from "./markdown.ts";
   import { createEventDispatcher } from "svelte";
   import type { EntityContentResponse, MeetingAgendaItem, MeetingMotion } from "../../src/types.ts";
   import ReaderLoading from "./ReaderLoading.svelte";
@@ -129,7 +129,7 @@
           </header>
 
           {#if item.description}
-            <div class="meeting-agenda__description">{@html item.description}</div>
+            <div class="meeting-agenda__description">{@html renderSupplierText(item.description)}</div>
           {/if}
 
           {#if item.documents?.length}
diff --git a/web/src/markdown.ts b/web/src/markdown.ts
index f8249e0..4d92d91 100644
--- a/web/src/markdown.ts
+++ b/web/src/markdown.ts
@@ -28,3 +28,39 @@ export function renderDocumentMarkdown(markdown?: string): string {
 export function renderOwnMarkdown(markdown: string): string {
   return parse(markdown);
 }
+
+/* The tags a supplier's HTML actually uses. Anything else in angle brackets
+ * is text and gets escaped: a stray `<script>` in plain text is not markup. */
+const HTML_TAG =
+  /<\/?(?:p|br|a|ul|ol|li|strong|b|em|i|u|div|span|h[1-6]|table|thead|tbody|tr|td|th|blockquote|hr)\b[^>]*>/i;
+
+/** Decode the numeric character references a supplier leaves in plain text
+ * (`&#xD;` for a carriage return is iBabs's favourite) so they neither show
+ * up literally after escaping nor survive as stray `\r`. */
+function decodeNumericEntities(text: string): string {
+  return text
+    .replaceAll(/&#x([0-9a-f]+);/gi, (_match, hex: string) =>
+      String.fromCodePoint(parseInt(hex, 16)),
+    )
+    .replaceAll(/&#(\d+);/g, (_match, dec: string) => String.fromCodePoint(parseInt(dec, 10)))
+    .replaceAll("\r", "");
+}
+
+/** Text a supplier wrote about a meeting or an agenda item, inserted with
+ * {@html}.
+ *
+ * Notubiz hands over HTML and that is shown as it is, as before. iBabs hands
+ * over plain text that griffies write with markdown in it: a link such as
+ * `[www.harderwijk.nl/vergaderingen](https://www.harderwijk.nl/vergaderingen)`
+ * used to appear with its brackets, unclickable (#295). Text without markup
+ * is now escaped and rendered as markdown, so links become links and line
+ * breaks survive, while nothing in it can become markup of its own. */
+export function renderSupplierText(text?: string): string {
+  if (!text?.trim()) {
+    return "";
+  }
+  if (HTML_TAG.test(text)) {
+    return text;
+  }
+  return parse(escapeMarkdownSource(decodeNumericEntities(text)));
+}