From 0bb4e57b0c646a20aa46e6cac545b37682629e89 Mon Sep 17 00:00:00 2001
From: Julia Johannesen <julia@insertdomain.name>
Date: Sun, 27 Apr 2025 13:05:09 -0400
Subject: Security fixes

Co-Authored-By: dakkar <dakkar@thenautilus.net>
---
 packages/backend/src/core/activitypub/ApRendererService.ts | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

(limited to 'packages/backend/src/core')

diff --git a/packages/backend/src/core/activitypub/ApRendererService.ts b/packages/backend/src/core/activitypub/ApRendererService.ts
index cb9b74f6d7..44eb029a35 100644
--- a/packages/backend/src/core/activitypub/ApRendererService.ts
+++ b/packages/backend/src/core/activitypub/ApRendererService.ts
@@ -496,9 +496,7 @@ export class ApRendererService {
 		const attachment = profile.fields.map(field => ({
 			type: 'PropertyValue',
 			name: field.name,
-			value: (field.value.startsWith('http://') || field.value.startsWith('https://'))
-				? `<a href="${new URL(field.value).href}" rel="me nofollow noopener" target="_blank">${new URL(field.value).href}</a>`
-				: field.value,
+			value: this.mfmService.toHtml(mfm.parse(field.value)),
 		}));
 
 		const emojis = await this.getEmojis(user.emojis);
-- 
cgit v1.2.3-freya