From c5183193495ac38ac8caff5fab90113b50dddfe0 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 20:43:40 +0400
Subject: [PATCH] fix(feed): correct RSS permalink metadata

---
 .../web/templates/feed/feed/_activity.rss.eex |  4 +--
 .../templates/feed/feed/_tag_activity.xml.eex |  4 +--
 test/pleroma/web/feed/tag_controller_test.exs | 33 +++++++++++++++++++
 3 files changed, 37 insertions(+), 4 deletions(-)

diff --git a/lib/pleroma/web/templates/feed/feed/_activity.rss.eex b/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
index 2127f554f..393501dad 100644
--- a/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
+++ b/lib/pleroma/web/templates/feed/feed/_activity.rss.eex
@@ -1,7 +1,7 @@
 <item>
   <activity:object-type>http://activitystrea.ms/schema/1.0/note</activity:object-type>
   <activity:verb>http://activitystrea.ms/schema/1.0/post</activity:verb>
-  <guid isPermaLink="true"><%= @data["id"] %></guid>
+  <guid isPermaLink="true"><%= escape(@data["id"] || "") %></guid>
   <title><%= activity_title(@data, Keyword.get(@feed_config, :post_title, %{})) %></title>
   <description><%= activity_description(@data) %></description>
   <content:encoded><![CDATA[<%= rss_content_encoded(@data) %>]]></content:encoded>
@@ -10,7 +10,7 @@
     <%= activity_context(@activity) %>
   </ostatus:conversation>
 
-  <link><%= activity_link(@activity, @data) %></link>
+  <link><%= escape(activity_link(@activity, @data) || "") %></link>
 
   <%= for tag <- Pleroma.Object.hashtags(@object) do %>
     <%= if tag && tag != "" do %>
diff --git a/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex b/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
index 09945605c..a8796353f 100644
--- a/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
+++ b/lib/pleroma/web/templates/feed/feed/_tag_activity.xml.eex
@@ -1,6 +1,6 @@
 <item>
-  <guid isPermalink="true"><%= activity_link(@activity, @data) %></guid>
-  <link><%= activity_link(@activity, @data) %></link>
+  <guid isPermaLink="true"><%= escape(activity_link(@activity, @data) || "") %></guid>
+  <link><%= escape(activity_link(@activity, @data) || "") %></link>
   <pubDate><%= to_rfc2822(@data["published"]) %></pubDate>
   <title><%= activity_title(@data, Keyword.get(@feed_config, :post_title, %{})) %></title>
   <description><%= activity_description(@data) %></description>
diff --git a/test/pleroma/web/feed/tag_controller_test.exs b/test/pleroma/web/feed/tag_controller_test.exs
index 9e8874455..eef524cc4 100644
--- a/test/pleroma/web/feed/tag_controller_test.exs
+++ b/test/pleroma/web/feed/tag_controller_test.exs
@@ -167,6 +167,8 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
              ~c"yeah #PleromaArt"
            ]
 
+    assert xpath(xml, ~x"//channel/item/guid/@isPermaLink"sl) == ["true", "true"]
+
     assert xpath(xml, ~x"//channel/item/pubDate/text()"sl) == [
              FeedView.to_rfc2822(activity2.data["published"]),
              FeedView.to_rfc2822(activity1.data["published"])
@@ -232,6 +234,37 @@ defmodule Pleroma.Web.Feed.TagControllerTest do
     refute response =~ "<lastBuildDate>"
   end
 
+  test "escapes and round-trips RSS item permalinks", %{conn: conn} do
+    user = insert(:user, local: false)
+    permalink = "https://remote.example/post?first=one&second=two"
+
+    note =
+      insert(:note,
+        user: user,
+        object_local: false,
+        data: %{
+          "content" => "remote #rsslink",
+          "external_url" => permalink,
+          "summary" => "",
+          "tag" => ["rsslink"]
+        }
+      )
+
+    insert(:note_activity, user: user, note: note, local: false, object_local: false)
+
+    response =
+      conn
+      |> put_req_header("accept", "application/rss+xml")
+      |> get(tag_feed_path(conn, :feed, "rsslink.rss"))
+      |> response(200)
+
+    assert response =~ "https://remote.example/post?first=one&amp;second=two"
+
+    xml = parse(response)
+    assert xpath(xml, ~x"//channel/item/guid/text()"s) == permalink
+    assert xpath(xml, ~x"//channel/item/link/text()"s) == permalink
+  end
+
   describe "private instance" do
     setup do: clear_config([:instance, :public], false)