diff --git a/lib/pleroma/web/feed/feed_view.ex b/lib/pleroma/web/feed/feed_view.ex index a433b8403..9724cc7f9 100644 --- a/lib/pleroma/web/feed/feed_view.ex +++ b/lib/pleroma/web/feed/feed_view.ex @@ -109,9 +109,8 @@ defmodule Pleroma.Web.Feed.FeedView do base_content = case activity_content(data) do "" -> - data["summary"] || data["type"] || - "" - |> escape() + (data["summary"] || data["type"] || "") + |> escape() content -> content diff --git a/test/pleroma/web/feed/feed_view_test.exs b/test/pleroma/web/feed/feed_view_test.exs new file mode 100644 index 000000000..3ff3b9bae --- /dev/null +++ b/test/pleroma/web/feed/feed_view_test.exs @@ -0,0 +1,22 @@ +# Pleroma: A lightweight social networking server +# Copyright © 2017-2022 Pleroma Authors +# SPDX-License-Identifier: AGPL-3.0-only + +defmodule Pleroma.Web.Feed.FeedViewTest do + use Pleroma.DataCase, async: true + + alias Pleroma.Web.Feed.FeedView + + test "escapes fallback content" do + data = %{ + "attachment" => [], + "content" => "", + "summary" => "" + } + + expected = "<script>alert('feed')</script>" + + assert FeedView.atom_content_encoded(data) == expected + assert FeedView.rss_content_encoded(data) == expected + end +end