fix(comments): sanitize raw run text for emoji alt attributes and harden parser guards

spec/invidious/comments_content_spec.cr

@@ -0,0 +1,29 @@
+require "../spec_helper"
+
+Spectator.describe "parse_content" do
+  it "sanitizes raw run text for emoji alt attributes if accessibility label is missing" do
+    payload = JSON.parse(%({
+      "runs": [
+        {
+          "text": "<script>alert(1)</script>",
+          "emoji": {
+            "image": {
+              "thumbnails": [
+                {
+                  "url": "http://example.com/image.jpg",
+                  "width": 24,
+                  "height": 24
+                }
+              ]
+            }
+          }
+        }
+      ]
+    }))
+
+    result = parse_content(payload)
+    expect(result).to contain("alt=\"&lt;script&gt;alert(1)&lt;/script&gt;\"")
+    expect(result).to contain("title=\"&lt;script&gt;alert(1)&lt;/script&gt;\"")
+    expect(result).to_not contain("<script>")
+  end
+end

src/invidious/comments/content.cr

@@ -67,7 +67,8 @@ def content_to_comment_html(content, video_id : String? = "")
         thumbnails = emoji_image["thumbnails"]?.try &.as_a?
         if thumbnails && (emoji_thumb = thumbnails.first?) && (thumb_url = emoji_thumb["url"]?.try &.as_s?)
           raw_label = emoji_image.dig?("accessibility", "accessibilityData", "label").try &.as_s?
-          emoji_alt = raw_label ? HTML.escape(raw_label) : text
+          raw_run_text = run["text"]?.try(&.as_s?) || ""
+          emoji_alt = raw_label ? HTML.escape(raw_label) : HTML.escape(raw_run_text)
 
           text = String.build do |str|
             str << %(<img alt=") << emoji_alt << "\" "