Skip to content
Snippets Groups Projects
  1. Nov 16, 2021
    • rinpatch's avatar
      entity_normalizer: Escape name when parsing user · d36b45ad
      rinpatch authored
      In January 2020 Pleroma backend stopped escaping HTML in display names
      and passed that responsibility on frontends, compliant with Mastodon's
      version of Mastodon API [1]. Pleroma-FE was subsequently modified to
      escape the display name [2], however only in the "name_html" field. This
      was fine however, since that's what the code rendering display names used.
      
      However, 2 months ago an MR [3] refactoring the way the frontend does emoji
      and mention rendering was merged. One of the things it did was moving away
      from doing emoji rendering in the entity normalizer and use the unescaped
      'user.name' in the rendering code, resulting in HTML injection being
      possible again.
      
      This patch escapes 'user.name' as well, as far as I can tell there is no
      actual use for an unescaped display name in frontend code, especially
      when it comes from MastoAPI, where it is not supposed to be HTML.
      
      [1]: pleroma/pleroma-fe!1052
      [2]: pleroma/pleroma!2167
      [3]: pleroma/pleroma-fe!1392
      d36b45ad
  2. Sep 09, 2021
  3. Sep 07, 2021
  4. Sep 05, 2021
  5. Sep 02, 2021
  6. Aug 30, 2021
Loading