moon
/
spc-pleroma
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'fix/2291-atom-feed-escape' into 'develop' 

Escaping in xml templates

Closes #2291

See merge request pleroma/pleroma!3126
This commit is contained in:
lain 2020-11-10 09:34:13 +00:00
parent db07b538a5 0c68b9ac13
commit 4a3d1e78f6
4 changed files with 29 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/pleroma/web/feed/feed_view.ex
View File

@ -83,7 +83,7 @@ def activity_content(%{"content" => content}) do
def activity_content(_), do: ""
def activity_context(activity), do: activity.data["context"]
def activity_context(activity), do: escape(activity.data["context"])
def attachment_href(attachment) do
attachment["url"]

2
lib/pleroma/web/templates/feed/feed/_activity.atom.eex
View File

@ -12,7 +12,7 @@
<link href="<%= activity_context(@activity) %>" rel="ostatus:conversation"/>
<%= if @data["summary"] do %>
<summary><%= @data["summary"] %></summary>
<summary><%= escape(@data["summary"]) %></summary>
<% end %>
<%= if @activity.local do %>

2
lib/pleroma/web/templates/feed/feed/_activity.rss.eex
View File

@ -12,7 +12,7 @@
<link rel="ostatus:conversation"><%= activity_context(@activity) %></link>
<%= if @data["summary"] do %>
<description><%= @data["summary"] %></description>
<description><%= escape(@data["summary"]) %></description>
<% end %>
<%= if @activity.local do %>

77
test/pleroma/web/feed/user_controller_test.exs
View File

@ -12,16 +12,17 @@ defmodule Pleroma.Web.Feed.UserControllerTest do
alias Pleroma.Object
alias Pleroma.User
alias Pleroma.Web.CommonAPI
alias Pleroma.Web.Feed.FeedView
setup do: clear_config([:static_fe, :enabled], false)
describe "feed" do
setup do: clear_config([:feed])
test "gets an atom feed", %{conn: conn} do
setup do
Config.put(
[:feed, :post_title],
%{max_length: 10, omission: "..."}
%{max_length: 15, omission: "..."}
)
activity = insert(:note_activity)
@ -29,7 +30,8 @@ test "gets an atom feed", %{conn: conn} do
note =
insert(:note,
data: %{
"content" => "This is :moominmamma: note ",
"content" => "This & this is :moominmamma: note ",
"source" => "This & this is :moominmamma: note ",
"attachment" => [
%{
"url" => [
@ -37,7 +39,9 @@ test "gets an atom feed", %{conn: conn} do
]
}
],
"inReplyTo" => activity.data["id"]
"inReplyTo" => activity.data["id"],
"context" => "2hu & as",
"summary" => "2hu & as"
}
)
@ -48,7 +52,7 @@ test "gets an atom feed", %{conn: conn} do
insert(:note,
user: user,
data: %{
"content" => "42 This is :moominmamma: note ",
"content" => "42 & This is :moominmamma: note ",
"inReplyTo" => activity.data["id"]
}
)
@ -56,6 +60,10 @@ test "gets an atom feed", %{conn: conn} do
note_activity2 = insert(:note_activity, note: note2)
object = Object.normalize(note_activity)
[user: user, object: object, max_id: note_activity2.id]
end
test "gets an atom feed", %{conn: conn, user: user, object: object, max_id: max_id} do
resp =
conn
|> put_req_header("accept", "application/atom+xml")
@ -67,13 +75,15 @@ test "gets an atom feed", %{conn: conn} do
|> SweetXml.parse()
|> SweetXml.xpath(~x"//entry/title/text()"l)
assert activity_titles == ['42 This...', 'This is...']
assert resp =~ object.data["content"]
assert activity_titles == ['42 &amp; Thi...', 'This &amp; t...']
assert resp =~ FeedView.escape(object.data["content"])
assert resp =~ FeedView.escape(object.data["summary"])
assert resp =~ FeedView.escape(object.data["context"])
resp =
conn
|> put_req_header("accept", "application/atom+xml")
|> get("/users/#{user.nickname}/feed", %{"max_id" => note_activity2.id})
|> get("/users/#{user.nickname}/feed", %{"max_id" => max_id})
|> response(200)
activity_titles =
@ -81,47 +91,10 @@ test "gets an atom feed", %{conn: conn} do
|> SweetXml.parse()
|> SweetXml.xpath(~x"//entry/title/text()"l)
assert activity_titles == ['This is...']
assert activity_titles == ['This &amp; t...']
end
test "gets a rss feed", %{conn: conn} do
Pleroma.Config.put(
[:feed, :post_title],
%{max_length: 10, omission: "..."}
)
activity = insert(:note_activity)
note =
insert(:note,
data: %{
"content" => "This is :moominmamma: note ",
"attachment" => [
%{
"url" => [
%{"mediaType" => "image/png", "href" => "https://pleroma.gov/image.png"}
]
}
],
"inReplyTo" => activity.data["id"]
}
)
note_activity = insert(:note_activity, note: note)
user = User.get_cached_by_ap_id(note_activity.data["actor"])
note2 =
insert(:note,
user: user,
data: %{
"content" => "42 This is :moominmamma: note ",
"inReplyTo" => activity.data["id"]
}
)
note_activity2 = insert(:note_activity, note: note2)
object = Object.normalize(note_activity)
test "gets a rss feed", %{conn: conn, user: user, object: object, max_id: max_id} do
resp =
conn
|> put_req_header("accept", "application/rss+xml")
@ -133,13 +106,15 @@ test "gets a rss feed", %{conn: conn} do
|> SweetXml.parse()
|> SweetXml.xpath(~x"//item/title/text()"l)
assert activity_titles == ['42 This...', 'This is...']
assert resp =~ object.data["content"]
assert activity_titles == ['42 &amp; Thi...', 'This &amp; t...']
assert resp =~ FeedView.escape(object.data["content"])
assert resp =~ FeedView.escape(object.data["summary"])
assert resp =~ FeedView.escape(object.data["context"])
resp =
conn
|> put_req_header("accept", "application/rss+xml")
|> get("/users/#{user.nickname}/feed.rss", %{"max_id" => note_activity2.id})
|> get("/users/#{user.nickname}/feed.rss", %{"max_id" => max_id})
|> response(200)
activity_titles =
@ -147,7 +122,7 @@ test "gets a rss feed", %{conn: conn} do
|> SweetXml.parse()
|> SweetXml.xpath(~x"//item/title/text()"l)
assert activity_titles == ['This is...']
assert activity_titles == ['This &amp; t...']
end
test "returns 404 for a missing feed", %{conn: conn} do