lemmy-ui icon indicating copy to clipboard operation
lemmy-ui copied to clipboard

Angle brackets (and the content that they enclose) get deleted when you submit a post with them

Open K4LCIFER opened this issue 2 years ago • 2 comments

Requirements

  • [X] This is a bug report, and if not, please post to https://lemmy.ml/c/lemmy_support instead.
  • [X] Please check to see if this issue already exists.
  • [X] It's a single bug. Do not report multiple bugs in one issue.
  • [X] It's a frontend issue, not a backend issue; Otherwise please create an issue on the backend repo instead.

Summary

If you write text such as <text>, it will get removed in its entirety.

Steps to Reproduce

  1. Write text enclosed in angle brackets in a post
  2. When you submit the post, the text, including the angle brackets, gets removed

Technical Details

OS: Arch Linux Browser: Firefox v116.0.3

Lemmy Instance Version

0.18.4

Lemmy Instance URL

lemm.ee

K4LCIFER avatar Aug 21 '23 07:08 K4LCIFER

A single < appears to be replaced with &lt;.

K4LCIFER avatar Aug 21 '23 07:08 K4LCIFER

I have found a workaround. HTML-escaping one or both of your angle brackets will cause them to show normally. For example, instead of <text> you should write &lt;text> or &lt;text&gt;. Both will appear as <text> This workaround does not work inside code blocks, as the HTML-escaping does not occur in there.

This bug is very likely caused by overzealous HTML injection prevention. I haven't looked at the code, but this has the potential to be a backend issue rather than a frontend one. Yes, the symptoms are on the frontend but the cause could be serverside tag removal.

No matter where the bug is, the solution is to properly escape potential tags instead of blindly removing them.

Pyroglyph avatar Nov 07 '23 19:11 Pyroglyph