pentacent / keila

Open Source Newsletter Tool.
https://keila.io
GNU Affero General Public License v3.0
1.36k stars 67 forks source link

Using html elements causing session breakdown #119

Closed JDPDO closed 1 year ago

JDPDO commented 2 years ago

What happens?

Using the specific character causing first some kind of session (dead-/live-)lock, then storage of corrupted entity, followed by internal server error (500). (From future: HTML enclosures are affected too.)

How to reproduce

  1. Create a new template, and name it as you want.
  2. Type the sign ` (U+0060, grave accent) in signature field.
  3. Things getting weird :confused:, let's get worse :smiling_imp:: Accept site reload and save the template.
  4. Try opening the template causing internal server error.
wmnnd commented 2 years ago

Thank you for reporting this issue. I haven’t been able to confirm it yet but I will take a closer look later.

Are you interested in helping create a fix for it?

JDPDO commented 2 years ago

Yes, but I started elixir programming only several weeks ago.

JDPDO commented 2 years ago

I've done some investigation. My foundings:

The error is caused by earmark's parser in mailings builder trying to parse an unfinished Gruber Markdown Text. The grave accent (`) encloses for code formatting. For example complet copy `this works` and paste. No errors will occur.

What I do not understand so far is: Why are all other enclosures like { and _ not affected?

JDPDO commented 2 years ago

The error goes further than assumed: All HTML element enclosures trigger an invalid template the moment only one element added.

Try adding <div>, <p>, ... triggers the bug.

JDPDO commented 2 years ago

What is if we are adding a function closing all open enclosures before passing text to earmarks parser?

JDPDO commented 2 years ago

Investigating deeper: Not using the rich text editor in campaigns edition triggers the bug too.

wmnnd commented 1 year ago

The bug that caused session breakdowns with invalid markup in the signature field has been fixed in #175.