search

element-hq / element-ios

A glossy Matrix collaboration client for iOS
https://element.io
Apache License 2.0
1.73k stars 486 forks source link

cmark adds <!-- raw HTML omitted --> when encountering inline tags in markdown #4239

Open deepbluev7 opened 3 years ago

deepbluev7 commented 3 years ago

Describe the bug If you accidentally add an inline tag, that isn't an actual HTML tag inside a message, like <client>, that gets stripped by cmark since version 0.29.0 and repaced with <!-- raw HTML omitted -->.

Example:

"formatted_body": "What I wanna get at is that it’d take a “different” client for matrix before it’s realistically easy to discern what the common denominator is between element and <!-- raw HTML omitted -->"

This is probably surprising to users. I'd recommend to instead set the unsafe flag and escape all html not safelisted in the matrix spec, so that <client> gets sent as &lt;client&gt; and it shows up as users expected. Alternatively the comment could at least be removed, but that is very confusing imo.

To Reproduce Steps to reproduce the behavior:

  1. Send a message with a word inside angle brackets, for example <element>
  2. Observe that <!-- raw HTML omitted --> is sent.

Expected behavior

<element> is sent.

Smartphone (please complete the following information):

Additional context Ask @deepbluev7:neko.dev, if you have any further questions. I implemented the same stuff in Nheko and I am just assuming you are using cmark from the output. ;-)

ShadowJonathan commented 3 years ago

(I was the one who encountered this bug, ask me further diagnostic questions if necessary)

lmamane commented 3 years ago

Reproduced in version 1.3.6

lmamane commented 3 years ago

Additionally, the user has no way to work around this; entering e.g. &lt;element&gt; shows &lt;element&gt; in the message, not <element>.

Funnily enough, the "&lt;element&gt;" message is sent as a plain msgtype:m.text with no format nor formatted_body field, while the "<element>" that gets removed is inside a message with format:org.matrix.custom.html and a formatted_body.

lmamane commented 3 years ago

I found a work-around: type as a message: <foo>put your message with &lt;client&gt; there This will display as: put your message with <client> there The first "<foo>" is just to trigger treating the message as format:org.matrix.custom.html

Still, that is all deep geekery; the message should just display as it was typed by the user, always.