search

brave / brave-browser

Brave browser for Android, iOS, Linux, macOS, Windows.
https://brave.com
Mozilla Public License 2.0
17.91k stars 2.34k forks source link

Need to unescape special characters in feed titles #26264

Closed stephendonner closed 1 year ago

stephendonner commented 2 years ago

Description

Need to unescape special characters in feed titles

Steps to Reproduce

  1. install 1.47.14
  2. launch Brave
  3. load brave://flags
  4. set brave://flags/#brave-news-v2 to Enabled
  5. click on Relaunch
  6. open a new-tab page
  7. click on Customize
  8. click on Brave News
  9. click on Turn on Brave News
  10. type food in the Discover search textfield
  11. look at the Food & Wine Magazine entry

Actual result:

Screen Shot 2022-10-25 at 6 04 23 PM

Expected result:

Food & Wine Magazine

Reproduces how often:

100%

Brave version (brave://version info)

Brave 1.47.14 Chromium: 107.0.5304.62 (Official Build) nightly (x86_64)
Revision 1eec40d3a5764881c92085aaee66d25075c159aa-refs/branch-heads/5304@{#942}
OS macOS Version 11.7.1 (Build 20G918)

Version/Channel Information:

Other Additional Information:

Miscellaneous Information:

cc @mattmcalister @rebron @fallaciousreasoning @petemill @brave/qa-team

diracdeltas commented 2 years ago

I suspect the original point of escaping was to avoid XSS/HTML injection in feed titles so please make sure the fix for this has sec review

fallaciousreasoning commented 1 year ago

I think this is related to https://github.com/brave/news-aggregator/issues/44

Note: I don't think we need to worry about XSS/HTML injection because the places this is used are either:

  1. On Android, and not HTML
  2. Via React, where HTML is escaped automatically
fallaciousreasoning commented 1 year ago

This seems to have been fixed a while ago!