From 61a1c84f4bed2cf84e6497233af79e4607fa05d9 Mon Sep 17 00:00:00 2001
From: Test User <test@example.com>
Date: Sat, 8 Aug 2026 15:51:21 -0400
Subject: [PATCH] fix(comments): add defensive guards for emoji thumbnails and
 correct attribute escaping

---
 src/invidious/comments/content.cr   | 28 ++++++++++++++++++----------
 src/invidious/videos/description.cr | 28 +++++++++++++++++++++++++++-
 2 files changed, 45 insertions(+), 11 deletions(-)

diff --git a/src/invidious/comments/content.cr b/src/invidious/comments/content.cr
index bbeb9065..6fac94b6 100644
--- a/src/invidious/comments/content.cr
+++ b/src/invidious/comments/content.cr
@@ -64,19 +64,27 @@ def content_to_comment_html(content, video_id : String? = "")
     # check for custom emojis
     if run["emoji"]?
       if emoji_image = run.dig?("emoji", "image")
-        emoji_alt = HTML.escape(emoji_image.dig?("accessibility", "accessibilityData", "label").try(&.as_s) || text)
-        emoji_thumb = emoji_image["thumbnails"][0]
-        text = String.build do |str|
-          str << %(<img alt=") << emoji_alt << "\" "
-          str << %(src="/ggpht) << URI.parse(emoji_thumb["url"].as_s).request_target << "\" "
-          str << %(title=") << emoji_alt << "\" "
-          str << %(width=") << emoji_thumb["width"] << "\" "
-          str << %(height=") << emoji_thumb["height"] << "\" "
-          str << %(class="channel-emoji" />)
+        thumbnails = emoji_image["thumbnails"]?.try &.as_a?
+        if thumbnails && (emoji_thumb = thumbnails.first?) && (thumb_url = emoji_thumb["url"]?.try &.as_s?)
+          raw_label = emoji_image.dig?("accessibility", "accessibilityData", "label").try &.as_s?
+          emoji_alt = raw_label ? HTML.escape(raw_label) : text
+
+          text = String.build do |str|
+            str << %(<img alt=") << emoji_alt << "\" "
+            str << %(src="/ggpht) << URI.parse(thumb_url).request_target << "\" "
+            str << %(title=") << emoji_alt << "\" "
+            if thumb_width = emoji_thumb["width"]?
+              str << %(width=") << thumb_width << "\" "
+            end
+            if thumb_height = emoji_thumb["height"]?
+              str << %(height=") << thumb_height << "\" "
+            end
+            str << %(class="channel-emoji" />)
+          end
         end
       else
         # Hide deleted channel emoji
-        text = ""
+        text = "" if text.starts_with?(':') && text.ends_with?(':')
       end
     end
 
diff --git a/src/invidious/videos/description.cr b/src/invidious/videos/description.cr
index 2c983269..f9779531 100644
--- a/src/invidious/videos/description.cr
+++ b/src/invidious/videos/description.cr
@@ -80,8 +80,34 @@ def parse_description(desc, video_id : String) : String?
       end
 
       link = cmd_content
+      
+      if command["emoji"]?
+        if emoji_image = command.dig?("emoji", "image")
+          thumbnails = emoji_image["thumbnails"]?.try &.as_a?
+          if thumbnails && (emoji_thumb = thumbnails.first?) && (thumb_url = emoji_thumb["url"]?.try &.as_s?)
+            raw_label = emoji_image.dig?("accessibility", "accessibilityData", "label").try &.as_s?
+            emoji_alt = raw_label ? HTML.escape(raw_label) : cmd_content
+
+            link = String.build do |s|
+              s << %(<img alt=") << emoji_alt << "\" "
+              s << %(src="/ggpht) << URI.parse(thumb_url).request_target << "\" "
+              s << %(title=") << emoji_alt << "\" "
+              if thumb_width = emoji_thumb["width"]?
+                s << %(width=") << thumb_width << "\" "
+              end
+              if thumb_height = emoji_thumb["height"]?
+                s << %(height=") << thumb_height << "\" "
+              end
+              s << %(class="channel-emoji" />)
+            end
+          end
+        else
+          link = "" if link.starts_with?(':') && link.ends_with?(':')
+        end
+      end
+
       if on_tap = command.dig?("onTap", "innertubeCommand")
-        link = parse_link_endpoint(on_tap, cmd_content, video_id)
+        link = parse_link_endpoint(on_tap, link, video_id)
       end
       str << link
       index += cmd_length