inveniosoftware / invenio-app-rdm

Turn-key research data management platform.
https://inveniordm.docs.cern.ch
MIT License
109 stars 149 forks source link

Journal title double escaped #2919

Closed ptamarit closed 10 hours ago

ptamarit commented 1 day ago

Package version (if known): v13.0.0b1.dev18

Describe the bug

The journal title field is double escaped, and characters like apostrophe are shown as HTML entities.

Steps to Reproduce

  1. Enable journal fields as described in Optional metadata by adding the following to invenio.cfg

    from invenio_rdm_records.contrib.journal import (
        JOURNAL_CUSTOM_FIELDS,
        JOURNAL_CUSTOM_FIELDS_UI,
        JOURNAL_NAMESPACE,
    )
    
    RDM_NAMESPACES = {
        **JOURNAL_NAMESPACE,
    }
    
    RDM_CUSTOM_FIELDS = [
        *JOURNAL_CUSTOM_FIELDS,
    ]
    
    RDM_CUSTOM_FIELDS_UI = [
        {
            "section": _("Publishing information"),
            "hide_from_landing_page": True,
            "fields": [
                *JOURNAL_CUSTOM_FIELDS_UI["fields"],
            ],
        },
    ]

    And then running pipenv run invenio rdm-records custom-fields init

  2. Create a new draft record.
  3. Under "Publishing information" > "Journal", type the following in the "Title" field: Journal <em>special</em> characters - _ . ! ~ * ' ( ) [ ] < > ; / ? : @ & = + $ , # % | \ "
  4. Go to your dashboard; the following text appears: Uploaded on ..., 2024 | Published in: Journal &lt;em&gt;special&lt;&#x2F;em&gt; characters - _ . ! ~ * &#39; ( ) [ ] &lt; &gt; ; &#x2F; ? : @ &amp; = + $ , # % | \ &quot;, 2024.
  5. Search for the record in the main screen; the same text appears.

Screenshot of the bug

before

Screenshot of the bug fix

after

Additional context

As specified in i18next documentation about Interpolation:

Per default, interpolation values get escaped to mitigate XSS attacks.

However, as shown in several places in the React-specific documentation (i18next instance, Getting started, Quick start), escaping interpolation values is not needed in when using React since React already escapes values.