From 89940d36f8d2682c0e256246b93b091374c3792a Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Wed, 3 Dec 2025 11:24:39 -0500
Subject: [PATCH] Gracefully handle ill-formed remote images in rich text

A better fix has been proposed upstream at
https://github.com/rails/rails/pull/56283 but this should be fine in
the meantime.

ref: https://app.fizzy.do/5986089/cards/3188
---
 .../action_text/attachables/_remote_image.html.erb    |  2 +-
 .../events/event/attachments/_remote_image.html.erb   |  2 +-
 test/controllers/cards_controller_test.rb             | 11 +++++++++++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/app/views/action_text/attachables/_remote_image.html.erb b/app/views/action_text/attachables/_remote_image.html.erb
index 174a95c5e..f71f5dcaa 100644
--- a/app/views/action_text/attachables/_remote_image.html.erb
+++ b/app/views/action_text/attachables/_remote_image.html.erb
@@ -1,5 +1,5 @@
 <figure class="attachment attachment--preview">
-  <%= image_tag remote_image.url, width: remote_image.width, height: remote_image.height %>
+  <%= image_tag remote_image.url, skip_pipeline: true, width: remote_image.width, height: remote_image.height %>
   <% if caption = remote_image.try(:caption) %>
     <figcaption class="attachment__caption">
       <%= caption %>
diff --git a/app/views/events/event/attachments/_remote_image.html.erb b/app/views/events/event/attachments/_remote_image.html.erb
index baec7f632..0eae78428 100644
--- a/app/views/events/event/attachments/_remote_image.html.erb
+++ b/app/views/events/event/attachments/_remote_image.html.erb
@@ -1 +1 @@
-<%= image_tag remote_image.url, class: "attachment attachment--image", width: remote_image.width, height: remote_image.height %>
+<%= image_tag remote_image.url, skip_pipeline: true, class: "attachment attachment--image", width: remote_image.width, height: remote_image.height %>
diff --git a/test/controllers/cards_controller_test.rb b/test/controllers/cards_controller_test.rb
index fd83eb577..ea5d4e50e 100644
--- a/test/controllers/cards_controller_test.rb
+++ b/test/controllers/cards_controller_test.rb
@@ -121,4 +121,15 @@ class CardsControllerTest < ActionDispatch::IntegrationTest
 
     assert_redirected_to boards(:writebook)
   end
+
+  test "show card with comment containing malformed remote image attachment" do
+    card = cards(:logo)
+    card.comments.create!(
+      creator: users(:kevin),
+      body: '<action-text-attachment url="image.png" content-type="image/*" presentation="gallery"></action-text-attachment>'
+    )
+
+    get card_path(card)
+    assert_response :success
+  end
 end