Don't memoize AutoLinkScrubber across format_html calls

The scrubber was memoized on the view helper in b0fa6525 so that
@regexp_timeout_reported would stop scanning remaining text nodes
after a timeout. But memoizing on the helper leaks that flag across
all format_html calls for the entire request — if one comment triggers
a timeout, every subsequent comment on the page loses auto-linking.

Use a fresh scrubber per call. The @regexp_timeout_reported flag still
works within a single document's scrub, which is the intended scope.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Mike Dalessio
2026-03-20 16:02:02 -04:00
parent 8c46ff52b4
commit 95a45aa651
+1 -2
View File
@@ -1,7 +1,6 @@
module HtmlHelper
def format_html(html)
@auto_link_scrubber ||= AutoLinkScrubber.new
Loofah::HTML5::DocumentFragment.parse(html).scrub!(@auto_link_scrubber).to_html.html_safe
Loofah::HTML5::DocumentFragment.parse(html).scrub!(AutoLinkScrubber.new).to_html.html_safe
end
def card_html_title(card)