move query string sanitizer to its own module & sanitize link cards as well

1 files changed, 4 insertions, 1 deletions

diff --git a/app/services/fetch_link_card_service.rb b/app/services/fetch_link_card_service.rb
index 494aaed75..561daf6e1 100644
--- a/app/services/fetch_link_card_service.rb
+++ b/app/services/fetch_link_card_service.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class FetchLinkCardService < BaseService
+  include UrlHelper
+
   URL_PATTERN = %r{
     (                                                                                                 #   $1 URL
       (https?:\/\/)                                                                                   #   $2 Protocol (required)
@@ -17,7 +19,8 @@ class FetchLinkCardService < BaseService
 
     return if @url.nil? || @status.preview_cards.any?
 
-    @url = @url.to_s
+    @url = sanitize_query_string(@url.to_s)
+    return if @url.nil?
 
     RedisLock.acquire(lock_options) do |lock|
       if lock.acquired?