4 people 2192af80f4 fix: html-escape captured values in helpcenter article markdown embeds (#14140) ...

Embed templates interpolate regex captures from user-authored article
URLs into HTML attribute values. CommonMark's angle-bracket link
destination syntax allows characters that the capture regexes don't
filter, so the unescaped substitution could produce malformed attribute
output. Escaping at substitution time keeps the render deterministic
regardless of the URL.

### How was this tested?
Added specs.

Fixes [CW-6934](https://linear.app/chatwoot/issue/CW-6934/)

Co-authored-by: Sony Mathew <sony@chatwoot.com>
Co-authored-by: Sivin Varghese <64252451+iamsivin@users.noreply.github.com>

2026-05-05 17:46:21 +05:30

..

captain

fix(captain): localize AI summary to account language (#13790)

2026-04-14 17:36:10 +05:30

email_templates

…

integrations

fix: render slack emoji shortcodes as unicode characters (#12928)

2026-04-29 23:19:52 +05:30

redis

…

webhooks

fix: [CW-6940] Fix SSRF issue for webhook trigger used by macros and automations (#14155)

2026-04-27 20:30:59 +05:30

base_markdown_renderer_spec.rb

fix: oversized email signature images in Letter render (#14144)

2026-04-27 13:31:43 +05:30

chatwoot_captcha_spec.rb

…

chatwoot_exception_tracker_spec.rb

…

chatwoot_hub_spec.rb

chore(hub): clean up legacy Captain hub flow (#13640)

2026-02-24 20:29:53 -08:00

chatwoot_markdown_renderer_spec.rb

fix: Email Channel links are not working (backend) (#13898)

2026-03-26 21:44:57 -07:00

config_loader_spec.rb

…

custom_markdown_renderer_spec.rb

fix: html-escape captured values in helpcenter article markdown embeds (#14140)

2026-05-05 17:46:21 +05:30

dyte_spec.rb

feat: Upgrade Dyte apis to v2 (#10706)

2025-02-19 14:47:48 -08:00

global_config_service_spec.rb

…

global_config_spec.rb

…

linear_spec.rb

feat(linear): Support refresh tokens and migrate legacy OAuth tokens (#13721)

2026-03-17 13:09:03 +04:00

online_status_tracker_spec.rb

perf: reduce presence update frequency and fix background tab throttling (#13726)

2026-03-09 18:23:44 +05:30

safe_fetch_spec.rb

fix: [CW-6940] Fix SSRF issue for webhook trigger used by macros and automations (#14155)

2026-04-27 20:30:59 +05:30

vapid_service_spec.rb

…