Emoji: First pass at support in Interactions

[obenland]

Should we sideload emoji images?

Fixes #970.

See https://mastodon.social/@obenland/113788023027390776
See https://obietester.blog/2025/01/06/99/#comment-31

Proposed changes:

• Adds callback function that replaces custom emoji strings with their image representations when available.
• Adds unit test to cover the new function.
• Runs author name and comment content through the new callback on insert and update.

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

• Go to Mastodon, for example, and reply to a federated test post with a custom emoji. :yikes:, :AngeryCat:, etc.
• Go to the comment list in wp-admin and make sure the emoji render as images.

[pfefferle]

I think before allowing images in comments, we have to think about/implement a proper blocking and moderation tooling (even more if it is about side-loading images): https://www.theverge.com/2023/7/24/23806093/mastodon-csam-study-decentralized-network

[obenland]

I just pushed an update that moves the replacement into a filter that runs after comment_content and the author have been sanitized. That way, only custom emoji images will be added to the content.

[jeherve]

Heads up: This PR adds img tags to the list of allowed HTML tags for Interactions!

Would sideloading the image onto the site with media_sideload_image be helpful here?

• It would ensure the images remain available in the future.
• It would avoid image hotlinking, which can be frowned upon.
• It would add some validation to the image data before to simply display it on the site.

Of course, we'd need to be okay adding potentially a lot of new media to a site once that's enabled. I'm not sure that's okay.

[obenland]

It would avoid image hotlinking, which can be frowned upon.

With custom emoji being shared tags, is that not kind of expected?

[jeherve]

With custom emoji being shared tags, is that not kind of expected?

I'm honestly not sure what the common practice is with other Fediverse software. From what I can tell, on Mastodon and on GoToSocial the images from remote instances seem to be cached on the local server:

GoToSocial:

Mastodon