Rich text markup in password is interpreted in preview pane

[swardman]

Overview

When a password containing rich text markup is revealed in the preview pane the markup is interpreted and the text is formatted.

Steps to Reproduce

1. in the main database view, add a new entry.
2. Enter the password: My<s>ecret, and click OK.
3. Select the new entry in the entries pane.
4. In the General tab in preview pane click the 👁 (eye) button to show the password.

Expected Behavior

Password is displayed in the preview pane as: My<s>ecret
(<s> is displayed literally)

Actual Behavior

Password is displayed in the preview pane as: Myecret
(<s> is interpreted and the following characters, "ecret", are struck through.)

Context

This only appears to affect the preview pane -- the password column in the entries pane if "hide passwords" is disabled and the password field in the add/edit entry window are not affected.

KeePassXC - Version 2.7.9
Revision: 8f6dd13

Qt 5.15.11
Debugging mode is disabled.

Operating system: Windows 11 Version 2009
CPU architecture: x86_64
Kernel: winnt 10.0.22631

---

KeePassXC - Version 2.7.6
Revision: dd21def

Qt 5.15.13
Debugging mode is disabled.

Operating system: Ubuntu 24.04.1 LTS
CPU architecture: x86_64
Kernel: linux 6.8.0-49-generic
Desktop Env: Gnome
Windowing System: Wayland

[swardman]

Markup in the title field is also interpreted, but not in Username, Tags, or Notes (although markup may be useful in Notes).

[droidmonkey]

Notes also do not render HTML since they are explicitly set to plain text to avoid interpretation. A separate request to support Markdown will be supported in 2.8.0 (#1057).

I fixed the others, before/after screenshots:

Advanced attributes are also ok, no changes needed:

[swardman]

With the commit HTML character references for symbols such as & are shown in the preview, sometimes. I think it's because the text format Qt::AutoText is deciding the text is plain text and double-encoding it. Explicitly setting the textFormat property on the labels to Qt::RichText does seem to fix it.

Before commit:

After commit:

[swardman]

Alternatively, go the other way don't HTML escape, explicitly set the text format to Qt::PlainText. However, the password entry needs rich text for the password colouring, and the notes entry will presumably use Qt::MarkdownText for the planned Markdown support.

[droidmonkey]

Oh that is unfortunate... maybe we need to implement a minimal escaping that just does the angle brackets

[swardman]

I had a play to try to work out what was going on, and I suspect it's just the way the text formatting for QLabel works, there should be no need to implement any different escaping. (Take with a pinch of salt, my Qt development experience is pretty much a dabble with PyQT years ago and following the getting started with Qt Widgets tutorial today.) I text edited the EntryPreviewWidget.ui file to set the textFormat properties to see if it worked, that's the extent of my testing so far.