HTML: special characters are exported as HTML entities in code blocks

[rachkor]

Steps to reproduce

1. Upload the OSCP compliance pack report template (html.erb file) and project (.zip file) from: https://dradisframework.com/academy/industry/compliance/oscp/index.html

2. Edit an instance of evidence to:

   #[Proof]#
   bc.. ['&"<>]

3. Export your project to the OSCP HTML report template

Expected behavior

The output should appear like:

bc.. ['&"<>]

Actual behavior

The output has HTML entities in the code block instead of characters:

System configuration

Dradis version: v3.11.0

[jumson]

Not just code blocks, but the inline code does the same thing for single and double quotes. Should I show POC here or make a separate issue?

[rachkor]

Could you open a new issue for that so that we can discuss? I believe it’s unrelated as we don’t support inline code.

[jumson]

Maybe I am calling something "inline code" and it is not. here is what I get -- both in the regular presentation and the HTML export. Anyways, the new HTML pull request will fix some of this --- which is what I am using to render.

The original text:

how it renders in browser

How the HTML exports it

[jumson]

UPDATE I think I found a clue. Check this weirdness out. My code for the codeblock is:

It renders like this:

And Exports like this:

So it renders the initial single quote and greater-than sign just fine, but the next single quote and all other characters it renders with HTML entities.

[dormi]

This PR fixes this: https://github.com/dradis/dradis-html_export/pull/20

[MattBudz]

resolved