From 6b8db71e2e9f27d2bd0dd34bf9006aa42b4516e5 Mon Sep 17 00:00:00 2001
From: David Taylor <david@taylorhq.com>
Date: Thu, 3 Apr 2025 14:41:17 +0100
Subject: [PATCH] DEV: Remove Handlebars dependency

Raw-handlebars will be removed from Discourse core imminently (https://github.com/discourse/discourse/pull/32081)

The usage in `custom-user-selector` seemed like it was expecting SafeString to actually do something to escape user input. It doesn't actually do any processing to the string. So I removed it, and added `escapeExpression` around the user input instead.

The usage in wizard-char-counter can be easily replaced with Ember's `htmlSafe` helper
---
 .../components/custom-user-selector.js        | 19 ++++++++-----------
 .../discourse/helpers/wizard-char-counter.js  | 10 +++++-----
 2 files changed, 13 insertions(+), 16 deletions(-)

diff --git a/assets/javascripts/discourse/components/custom-user-selector.js b/assets/javascripts/discourse/components/custom-user-selector.js
index ca6dfbdbd..64812607f 100644
--- a/assets/javascripts/discourse/components/custom-user-selector.js
+++ b/assets/javascripts/discourse/components/custom-user-selector.js
@@ -1,14 +1,11 @@
 import { isEmpty } from "@ember/utils";
-import Handlebars from "handlebars";
 import $ from "jquery";
 import TextField from "discourse/components/text-field";
 import { renderAvatar } from "discourse/helpers/user-avatar";
+import { default as computed, observes } from "discourse/lib/decorators";
 import userSearch from "discourse/lib/user-search";
-import {
-  default as computed,
-  observes,
-} from "discourse-common/utils/decorators";
-import I18n from "I18n";
+import { escapeExpression } from "discourse/lib/utilities";
+import { i18n } from "discourse-i18n";
 
 const template = function (params) {
   const options = params.options;
@@ -17,11 +14,11 @@ const template = function (params) {
   if (options.users) {
     html += "<ul>";
     options.users.forEach((u) => {
-      html += `<li><a href title="${u.name}">`;
+      html += `<li><a href title="${escapeExpression(u.name)}">`;
       html += renderAvatar(u, { imageSize: "tiny" });
-      html += `<span class='username'>${u.username}</span>`;
+      html += `<span class='username'>${escapeExpression(u.username)}</span>`;
       if (u.name) {
-        html += `<span class='name'>${u.name}</span>`;
+        html += `<span class='name'>${escapeExpression(u.name)}</span>`;
       }
       html += `</a></li>`;
     });
@@ -30,7 +27,7 @@ const template = function (params) {
 
   html += "</div>";
 
-  return new Handlebars.SafeString(html).string;
+  return html;
 };
 
 export default TextField.extend({
@@ -42,7 +39,7 @@ export default TextField.extend({
 
   @computed("placeholderKey")
   placeholder(placeholderKey) {
-    return placeholderKey ? I18n.t(placeholderKey) : "";
+    return placeholderKey ? i18n(placeholderKey) : "";
   },
 
   @observes("usernames")
diff --git a/assets/javascripts/discourse/helpers/wizard-char-counter.js b/assets/javascripts/discourse/helpers/wizard-char-counter.js
index 13f9d6926..d994b9b1c 100644
--- a/assets/javascripts/discourse/helpers/wizard-char-counter.js
+++ b/assets/javascripts/discourse/helpers/wizard-char-counter.js
@@ -1,5 +1,5 @@
-import Handlebars from "handlebars";
-import I18n from "I18n";
+import { htmlSafe } from "@ember/template";
+import { i18n } from "discourse-i18n";
 
 export default function wizardCharCounter(body, maxLength) {
   let bodyLength = body ? body.length : 0;
@@ -7,15 +7,15 @@ export default function wizardCharCounter(body, maxLength) {
 
   if (maxLength) {
     let isOverMax = bodyLength > maxLength ? "true" : "false";
-    finalString = `<div class="body-length" data-length=${bodyLength} data-over-max=${isOverMax}>${bodyLength} / ${I18n.t(
+    finalString = `<div class="body-length" data-length=${bodyLength} data-over-max=${isOverMax}>${bodyLength} / ${i18n(
       "wizard.x_characters",
       { count: parseInt(maxLength, 10) }
     )}</div>`;
   } else {
-    finalString = `<div class="body-length">${I18n.t("wizard.x_characters", {
+    finalString = `<div class="body-length">${i18n("wizard.x_characters", {
       count: parseInt(bodyLength, 10),
     })}</div>`;
   }
 
-  return new Handlebars.SafeString(finalString);
+  return htmlSafe(finalString);
 }