From 4fb9e0a189fa7d54968495a70756748f34929c06 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mat=C3=ADas=20Insaurralde?= <matias@insaurral.de>
Date: Tue, 10 Mar 2026 20:19:19 -0300
Subject: [PATCH] markup/sanitizer: build bluemonday policies once at package
 init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both policies were rebuilt on every NewSanitizer() call. This included
compiling the chroma syntax-highlight class regex by iterating
chroma.StandardTypes and joining ~200 type names into a regex alternation,
on every invocation — including from inside the pull request HTTP handler,
making it a per-request cost.

Move both policies to package-level vars initialized once in init().
NewSanitizer() is now a pair of pointer assignments. This is safe per the
bluemonday README: "it is safe to use the policy in multiple goroutines".

Signed-off-by: Matías Insaurralde <matias@insaurral.de>
---
 appview/pages/markup/sanitizer.go | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/appview/pages/markup/sanitizer.go b/appview/pages/markup/sanitizer.go
index 72f74efd..c2e08096 100644
--- a/appview/pages/markup/sanitizer.go
+++ b/appview/pages/markup/sanitizer.go
@@ -10,6 +10,17 @@ import (
 	"github.com/microcosm-cc/bluemonday"
 )
 
+// shared policies built once at init; safe for concurrent use per bluemonday docs
+var (
+	sharedDefaultPolicy     *bluemonday.Policy
+	sharedDescriptionPolicy *bluemonday.Policy
+)
+
+func init() {
+	sharedDefaultPolicy = buildDefaultPolicy()
+	sharedDescriptionPolicy = buildDescriptionPolicy()
+}
+
 type Sanitizer struct {
 	defaultPolicy     *bluemonday.Policy
 	descriptionPolicy *bluemonday.Policy
@@ -17,8 +28,8 @@ type Sanitizer struct {
 
 func NewSanitizer() Sanitizer {
 	return Sanitizer{
-		defaultPolicy:     defaultPolicy(),
-		descriptionPolicy: descriptionPolicy(),
+		defaultPolicy:     sharedDefaultPolicy,
+		descriptionPolicy: sharedDescriptionPolicy,
 	}
 }
 
@@ -29,7 +40,7 @@ func (s *Sanitizer) SanitizeDescription(html string) string {
 	return s.descriptionPolicy.Sanitize(html)
 }
 
-func defaultPolicy() *bluemonday.Policy {
+func buildDefaultPolicy() *bluemonday.Policy {
 	policy := bluemonday.UGCPolicy()
 
 	// Allow generally safe attributes
@@ -123,7 +134,7 @@ func defaultPolicy() *bluemonday.Policy {
 	return policy
 }
 
-func descriptionPolicy() *bluemonday.Policy {
+func buildDescriptionPolicy() *bluemonday.Policy {
 	policy := bluemonday.NewPolicy()
 	policy.AllowStandardURLs()
 
-- 
2.51.2