From 3c2608d41c3e19c3037571b9102f73b743053fbc Mon Sep 17 00:00:00 2001
From: David Taylor <david@taylorhq.com>
Date: Thu, 4 Oct 2018 15:15:10 +0100
Subject: [PATCH] FIX: Correctly censor strings starting or ending with
 non-word characters (#6445)

---
 .../pretty-text/censored-words.js.es6         | 14 ++++++-------
 test/javascripts/lib/pretty-text-test.js.es6  | 21 ++++++++++++++++++-
 2 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/app/assets/javascripts/pretty-text/censored-words.js.es6 b/app/assets/javascripts/pretty-text/censored-words.js.es6
index badaeb322cc..32c21dc39b6 100644
--- a/app/assets/javascripts/pretty-text/censored-words.js.es6
+++ b/app/assets/javascripts/pretty-text/censored-words.js.es6
@@ -2,6 +2,10 @@ function escapeRegexp(text) {
   return text.replace(/[-/\\^$*+?.()|[\]{}]/g, "\\$&").replace(/\*/g, "S*");
 }
 
+function createCensorRegexp(patterns) {
+  return new RegExp(`((?<!\\w)(?:${patterns.join("|")}))(?!\\w)`, "ig");
+}
+
 export function censorFn(
   censoredWords,
   replacementLetter,
@@ -28,10 +32,7 @@ export function censorFn(
           "ig"
         );
       } else {
-        censorRegexp = new RegExp(
-          "(\\b(?:" + patterns.join("|") + ")\\b)(?![^\\(]*\\))",
-          "ig"
-        );
+        censorRegexp = createCensorRegexp(patterns);
       }
 
       if (censorRegexp) {
@@ -53,10 +54,7 @@ export function censorFn(
                   replacementLetter
                 );
                 text = text.replace(
-                  new RegExp(
-                    `(\\b${escapeRegexp(m[0])}\\b)(?![^\\(]*\\))`,
-                    "ig"
-                  ),
+                  createCensorRegexp([escapeRegexp(m[0])]),
                   replacement
                 );
               }
diff --git a/test/javascripts/lib/pretty-text-test.js.es6 b/test/javascripts/lib/pretty-text-test.js.es6
index c7313b99da8..5c4846a6f5e 100644
--- a/test/javascripts/lib/pretty-text-test.js.es6
+++ b/test/javascripts/lib/pretty-text-test.js.es6
@@ -16,7 +16,7 @@ const rawOpts = {
     enable_markdown_linkify: true,
     markdown_linkify_tlds: "com"
   },
-  censoredWords: "shucks|whiz|whizzer|a**le|badword*",
+  censoredWords: "shucks|whiz|whizzer|a**le|badword*|shuck$|café|$uper",
   getURL: url => url
 };
 
@@ -959,6 +959,25 @@ QUnit.test("censoring", assert => {
     "<p>I have a pen, I have an ■■■■■</p>",
     "it escapes regexp chars"
   );
+
+  assert.cooked(
+    "Aw shuck$, I can't fix the problem with money",
+    "<p>Aw ■■■■■■, I can't fix the problem with money</p>",
+    "it works for words ending in non-word characters"
+  );
+
+  assert.cooked(
+    "Let's go to a café today",
+    "<p>Let's go to a ■■■■ today</p>",
+    "it works for words ending in accented characters"
+  );
+
+  assert.cooked(
+    "Discourse is $uper amazing",
+    "<p>Discourse is ■■■■■ amazing</p>",
+    "it works for words starting with non-word characters"
+  );
+
   assert.cooked(
     "No badword or apple here plz.",
     "<p>No ■■■■■■■ or ■■■■■ here plz.</p>",