announcement v1

internal/template/announcement.go

@@ -0,0 +1,50 @@
+// Copyright 2026 tamakyi. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package template
+
+import (
+	"html"
+	"regexp"
+	"strings"
+
+	htmltemplate "html/template"
+)
+
+// 公告正文里的 http(s) 地址自动变链接。
+var announcementURLRe = regexp.MustCompile(`https?://[^\s<>"']+`)
+
+// 句末标点不属于 URL：中文公告里「详见 https://example.com/x。」很常见，
+// 不剥离就会把「。」一起链进去。
+const announcementURLTailChars = ".,;:!?)]}，。；：！？）】」”’"
+
+// AnnouncementHTML 把配置里的纯文本公告渲染成安全 HTML。
+//
+// 按 URL 切段、逐段转义，而不是「先整体转义再正则」：转义后的 &#34; 会被 URL
+// 字符类当成普通字符吞进链接。链接的 href 与可见文本共用同一份转义结果，
+// 因此不存在属性逃逸；内容里的 HTML 标签一律按字面显示。
+func AnnouncementHTML(raw string) htmltemplate.HTML {
+	raw = strings.ReplaceAll(raw, "\r\n", "\n")
+	raw = strings.ReplaceAll(raw, `\r\n`, "\n")
+	raw = strings.ReplaceAll(raw, `\n`, "\n")
+
+	var b strings.Builder
+	last := 0
+	for _, loc := range announcementURLRe.FindAllStringIndex(raw, -1) {
+		url := raw[loc[0]:loc[1]]
+		core := strings.TrimRight(url, announcementURLTailChars)
+		tail := url[len(core):]
+		b.WriteString(escapeAnnouncementText(raw[last:loc[0]]))
+		escaped := html.EscapeString(core)
+		b.WriteString(`<a href="` + escaped + `" target="_blank" rel="noopener noreferrer nofollow">` + escaped + `</a>`)
+		b.WriteString(escapeAnnouncementText(tail))
+		last = loc[1]
+	}
+	b.WriteString(escapeAnnouncementText(raw[last:]))
+	return htmltemplate.HTML(b.String())
+}
+
+func escapeAnnouncementText(s string) string {
+	return strings.ReplaceAll(html.EscapeString(s), "\n", "<br>")
+}