From edd7e553132d2ac5e3d16598804e368c50ed3149 Mon Sep 17 00:00:00 2001
From: Jason Zimdars <jz@37signals.com>
Date: Fri, 14 Feb 2025 11:23:08 -0600
Subject: [PATCH] Prevent using `#` in the stored tag name

---
 app/controllers/taggings/toggles_controller.rb | 3 ++-
 app/models/tag.rb                              | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/app/controllers/taggings/toggles_controller.rb b/app/controllers/taggings/toggles_controller.rb
index c528adadd..d2cca90f4 100644
--- a/app/controllers/taggings/toggles_controller.rb
+++ b/app/controllers/taggings/toggles_controller.rb
@@ -3,7 +3,8 @@ class Taggings::TogglesController < ApplicationController
 
   def create
     if params[:tag_title].present?
-      @bubble.toggle_tag Current.account.tags.create!(title: params[:tag_title])
+      sanitized_title = params[:tag_title].strip.gsub(/\A#/, "")
+      @bubble.toggle_tag Current.account.tags.create!(title: sanitized_title)
     else
       new_tag_ids = Array(params[:tag_id])
       current_tags = @bubble.tags
diff --git a/app/models/tag.rb b/app/models/tag.rb
index 73f7112e7..a9fd6adba 100644
--- a/app/models/tag.rb
+++ b/app/models/tag.rb
@@ -6,6 +6,8 @@ class Tag < ApplicationRecord
   has_many :taggings, dependent: :destroy
   has_many :bubbles, through: :taggings
 
+  validates :title, format: { without: /\A#/ }
+
   def hashtag
     "#" + title
   end