fix(feed): escape self link URLs

lib/pleroma/web/feed/feed_view.ex

@@ -167,7 +167,11 @@ defmodule Pleroma.Web.Feed.FeedView do
 
   def activity_context(activity), do: escape(activity.data["context"])
 
-  def feed_self_url(conn), do: Phoenix.Controller.current_url(conn)
+  def feed_self_url(conn) do
+    conn
+    |> Phoenix.Controller.current_url()
+    |> escape()
+  end
 
   def activity_link(activity, data) do
     cond do

test/pleroma/web/feed/user_controller_test.exs

@@ -138,6 +138,18 @@ defmodule Pleroma.Web.Feed.UserControllerTest do
       assert activity_titles == [~c"2hu & as"]
     end
 
+    test "escapes query parameters in feed self links", %{conn: conn, user: user} do
+      for format <- ~w[atom rss] do
+        response =
+          conn
+          |> get("/users/#{user.nickname}/feed.#{format}?first=one&second=two")
+          |> response(200)
+
+        assert response =~ "first=one&amp;second=two"
+        refute response =~ "first=one&second=two"
+      end
+    end
+
     test "returns 404 for a missing feed", %{conn: conn} do
       conn =
         conn