From d0c8ca92a5885fbd4919273300cd952f87bea661 Mon Sep 17 00:00:00 2001 From: Lain Soykaf Date: Fri, 24 Jul 2026 20:11:19 +0400 Subject: [PATCH] fix(feed): escape self link URLs --- lib/pleroma/web/feed/feed_view.ex | 6 +++++- test/pleroma/web/feed/user_controller_test.exs | 12 ++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/lib/pleroma/web/feed/feed_view.ex b/lib/pleroma/web/feed/feed_view.ex index f8bc94504..ade9f7a15 100644 --- a/lib/pleroma/web/feed/feed_view.ex +++ b/lib/pleroma/web/feed/feed_view.ex @@ -167,7 +167,11 @@ defmodule Pleroma.Web.Feed.FeedView do def activity_context(activity), do: escape(activity.data["context"]) - def feed_self_url(conn), do: Phoenix.Controller.current_url(conn) + def feed_self_url(conn) do + conn + |> Phoenix.Controller.current_url() + |> escape() + end def activity_link(activity, data) do cond do diff --git a/test/pleroma/web/feed/user_controller_test.exs b/test/pleroma/web/feed/user_controller_test.exs index 916531cd5..5dfe6aa89 100644 --- a/test/pleroma/web/feed/user_controller_test.exs +++ b/test/pleroma/web/feed/user_controller_test.exs @@ -138,6 +138,18 @@ defmodule Pleroma.Web.Feed.UserControllerTest do assert activity_titles == [~c"2hu & as"] end + test "escapes query parameters in feed self links", %{conn: conn, user: user} do + for format <- ~w[atom rss] do + response = + conn + |> get("/users/#{user.nickname}/feed.#{format}?first=one&second=two") + |> response(200) + + assert response =~ "first=one&second=two" + refute response =~ "first=one&second=two" + end + end + test "returns 404 for a missing feed", %{conn: conn} do conn = conn