search

CodedOre / NewCaw

Development on Cawbird 2.0
GNU General Public License v3.0
97 stars 5 forks source link

Use of unescaped profile content #43

Closed IBBoard closed 2 years ago

IBBoard commented 2 years ago

I've got to check exactly where it's happening, but we're getting Failed to set text '<a href="https://ibboard.co.uk/?ibbtwtr&test" title="https://ibboard.co.uk/?ibbtwtr&test" class="weblink">ibboard.co.uk/?ibbtwtr&test</a>' from markup due to error parsing markup: Error on line 1: Entity did not end with a semicolon; most likely you used an ampersand character without intending to start an entity — escape ampersand as &amp; when I use my IBBTwttr account. Possibly ibboard/cawbird#78?

CodedOre commented 2 years ago

That seems to happen on setting the link on UserDisplay.

So, think we need to add Markup.escaped_text to TextUtils.format_text. Is (hopefully) easy enough to fix.

CodedOre commented 2 years ago

Should be fixed from our side.

However, I noticed something interesting: If we set this:

<a title="https://ibboard.co.uk/?ibbtwtr&amp;test">ibboard.co.uk/?ibbtwtr&amp;test</a>

It moves the problem down to the hover view...

IBBoard commented 2 years ago

That's why I set it on my test account 😁 I remember having to fight with how many times the text is encoded to get the title to work. It's because the entity encoding resolves it for valid HTML, but then GTK takes the string from the HTML (which returns the decoded version) and sets that as markup on the tooltip.

CodedOre commented 2 years ago

I'm actually surprised that GTK allows the markup on the tooltip as well...

So, we need to double escape the text for tooltips then...