From 9ef040f0ec32db6993c0a31db2842bf115db0e4b Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Mon, 27 Oct 2025 19:12:07 -0400
Subject: [PATCH] Sanitize similar content avatars

---
 js/ui/components/SimilarContentCard.js | 20 ++++++++++++++++----
 js/ui/components/VideoModal.js         | 22 ++++++++++++++++++++--
 2 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/js/ui/components/SimilarContentCard.js b/js/ui/components/SimilarContentCard.js
index 904d761a..8cdb6be8 100644
--- a/js/ui/components/SimilarContentCard.js
+++ b/js/ui/components/SimilarContentCard.js
@@ -1,5 +1,6 @@
 import { normalizeDesignSystemContext } from "../../designSystem.js";
 import { formatShortNpub } from "../../utils/formatters.js";
+import { sanitizeProfileMediaUrl } from "../../utils/profileMedia.js";
 
 const DEFAULT_PROFILE_AVATAR = "assets/svg/default-profile.svg";
 
@@ -213,15 +214,26 @@ export class SimilarContentCard {
           continue;
         }
         const trimmed = entry.trim();
-        if (trimmed) {
-          return trimmed;
+        if (!trimmed) {
+          continue;
+        }
+        const sanitized = sanitizeProfileMediaUrl(trimmed);
+        if (sanitized) {
+          return sanitized;
         }
       }
 
-      return "";
+      const fallback =
+        typeof baseline.picture === "string" && baseline.picture.trim()
+          ? sanitizeProfileMediaUrl(baseline.picture) || baseline.picture.trim()
+          : "";
+
+      return fallback;
     })();
 
-    return { name, npub, shortNpub, pubkey, picture };
+    const resolvedPicture = picture || DEFAULT_PROFILE_AVATAR;
+
+    return { name, npub, shortNpub, pubkey, picture: resolvedPicture };
   }
 
   applyIdentityToElements() {
diff --git a/js/ui/components/VideoModal.js b/js/ui/components/VideoModal.js
index b0f702ea..2683cd40 100644
--- a/js/ui/components/VideoModal.js
+++ b/js/ui/components/VideoModal.js
@@ -5063,12 +5063,30 @@ export class VideoModal {
         continue;
       }
       const trimmed = candidate.trim();
-      if (trimmed) {
-        picture = trimmed;
+      if (!trimmed) {
+        continue;
+      }
+      const sanitized = sanitizeProfileMediaUrl(trimmed);
+      if (sanitized) {
+        picture = sanitized;
         break;
       }
     }
 
+    if (!picture && pubkey) {
+      const robohash = `https://robohash.org/${pubkey}`;
+      picture = sanitizeProfileMediaUrl(robohash) || robohash;
+    }
+
+    if (!picture) {
+      const fallbackAvatar =
+        typeof this.DEFAULT_PROFILE_AVATAR === "string" &&
+        this.DEFAULT_PROFILE_AVATAR.trim()
+          ? this.DEFAULT_PROFILE_AVATAR.trim()
+          : "assets/svg/default-profile.svg";
+      picture = sanitizeProfileMediaUrl(fallbackAvatar) || fallbackAvatar;
+    }
+
     return {
       name,
       npub,