From a9bf7212d495c5005789768f63d302fc4677f120 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 19:59:18 +0400
Subject: [PATCH] fix(feed): escape fallback content

---
 lib/pleroma/web/feed/feed_view.ex        |  5 ++---
 test/pleroma/web/feed/feed_view_test.exs | 22 ++++++++++++++++++++++
 2 files changed, 24 insertions(+), 3 deletions(-)
 create mode 100644 test/pleroma/web/feed/feed_view_test.exs

diff --git a/lib/pleroma/web/feed/feed_view.ex b/lib/pleroma/web/feed/feed_view.ex
index a433b8403..9724cc7f9 100644
--- a/lib/pleroma/web/feed/feed_view.ex
+++ b/lib/pleroma/web/feed/feed_view.ex
@@ -109,9 +109,8 @@ defmodule Pleroma.Web.Feed.FeedView do
     base_content =
       case activity_content(data) do
         "" ->
-          data["summary"] || data["type"] ||
-            ""
-            |> escape()
+          (data["summary"] || data["type"] || "")
+          |> escape()
 
         content ->
           content
diff --git a/test/pleroma/web/feed/feed_view_test.exs b/test/pleroma/web/feed/feed_view_test.exs
new file mode 100644
index 000000000..3ff3b9bae
--- /dev/null
+++ b/test/pleroma/web/feed/feed_view_test.exs
@@ -0,0 +1,22 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.Feed.FeedViewTest do
+  use Pleroma.DataCase, async: true
+
+  alias Pleroma.Web.Feed.FeedView
+
+  test "escapes fallback content" do
+    data = %{
+      "attachment" => [],
+      "content" => "",
+      "summary" => "<script>alert('feed')</script>"
+    }
+
+    expected = "&lt;script&gt;alert(&#39;feed&#39;)&lt;/script&gt;"
+
+    assert FeedView.atom_content_encoded(data) == expected
+    assert FeedView.rss_content_encoded(data) == expected
+  end
+end