Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Need to unescape special characters in feed titles #26264

Closed
stephendonner opened this issue Oct 26, 2022 · 3 comments
Closed

Need to unescape special characters in feed titles #26264

stephendonner opened this issue Oct 26, 2022 · 3 comments

Comments

@stephendonner
Copy link

Description

Need to unescape special characters in feed titles

Steps to Reproduce

  1. install 1.47.14
  2. launch Brave
  3. load brave://flags
  4. set brave://flags/#brave-news-v2 to Enabled
  5. click on Relaunch
  6. open a new-tab page
  7. click on Customize
  8. click on Brave News
  9. click on Turn on Brave News
  10. type food in the Discover search textfield
  11. look at the Food & Wine Magazine entry

Actual result:

Screen Shot 2022-10-25 at 6 04 23 PM

Expected result:

Food & Wine Magazine

Reproduces how often:

100%

Brave version (brave://version info)

Brave 1.47.14 Chromium: 107.0.5304.62 (Official Build) nightly (x86_64)
Revision 1eec40d3a5764881c92085aaee66d25075c159aa-refs/branch-heads/5304@{#942}
OS macOS Version 11.7.1 (Build 20G918)

Version/Channel Information:

  • Can you reproduce this issue with the current release?
  • Can you reproduce this issue with the beta channel?
  • Can you reproduce this issue with the nightly channel?

Other Additional Information:

  • Does the issue resolve itself when disabling Brave Shields?
  • Does the issue resolve itself when disabling Brave Rewards?
  • Is the issue reproducible on the latest version of Chrome?

Miscellaneous Information:

cc @mattmcalister @rebron @fallaciousreasoning @petemill @brave/qa-team

@diracdeltas
Copy link
Member

I suspect the original point of escaping was to avoid XSS/HTML injection in feed titles so please make sure the fix for this has sec review

@fallaciousreasoning
Copy link

I think this is related to https://github.com/brave/news-aggregator/issues/44

Note: I don't think we need to worry about XSS/HTML injection because the places this is used are either:

  1. On Android, and not HTML
  2. Via React, where HTML is escaped automatically

@fallaciousreasoning
Copy link

This seems to have been fixed a while ago!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants