LotusGuild/cinny
3
0
Fork 0
Code Issues 55 Pull Requests 8 Actions 7 Packages Projects Releases Wiki Activity

Room topic editor mangles URLs and aliases that contain _ or * (broken links for every client) #262

New Issue
Closed
opened 2026-10-04 17:41:25 -04:00 by jared · 0 comments
jared commented 2026-10-04 17:41:25 -04:00
Owner
Copy Link
Copy Source

What happens
The topic editor's home-made markdown (src/app/features/common-settings/general/RoomProfile.tsx:56, 74-96) treats any single _ or * as markdown. So ordinary topics get rewritten when saved:

Typed topic Saved formatted_body Saved plain topic (header + other clients)
Rules: https://wiki.lotusguild.org/en/server_rules_and_faq …/server<em>rules</em>and_faq …/serverrulesand_faq (broken URL)
[Our wiki](https://wiki.example.org/my_cool_page) <a href="https://wiki.example.org/my<em>cool</em>page"> Our wiki
Join #my_room_name:matrix.org #my<em>room</em>name:… #myroomname:… (wrong alias)

(Reproduced by running the same functions in node.)

Why

  • MARKDOWN_PATTERN = /(\*\*|__|\*|_|~~||[.+?](.+?))/matches any single_`.
  • The emphasis replacements run before, and inside, links and bare URLs.
  • The plain topic is derived by stripping tags, so the underscores are lost for good.
  • " isn't escaped, so [x](https://a" onclick="…) yields attribute injection in the stored formatted_body. It's sanitized when rendered, but it's still malformed HTML in room state that every client receives.

Fix ideas

  • Use the composer's markdown pipeline (the same one messages use), or at least:
    • leave URLs and #alias:server / @user:server tokens alone;
    • require word boundaries for _…_;
    • escape ";
    • derive the plain topic from the user's original text, not from the stripped HTML.

More context

Introduced by 16a15efe (2026-06-01, "P0 post-deploy bug fixes"), the hand-rolled topicMarkdownToHtml / buildTopicContent.

Who: anyone editing a room or space topic in Lotus. The damage is stored in room state, so every member on every client sees the broken link or alias.

Manual repro

  1. Room Settings → General → Edit, and set the topic to Rules: https://wiki.lotusguild.org/en/server_rules_and_faq.
  2. Save, then look at the room header or open the room in Element.
  3. Actual: the link reads …/serverrulesand_faq (and the formatted topic has <em> inside the URL). Expected: the URL is untouched.

Acceptance criteria

  • URLs, #alias:server and @user:server survive verbatim in both topic and formatted_body.
  • _/* emphasis only at word boundaries.
  • " is escaped.
  • Unit tests for the three examples above.

Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny 30e2dbcd, cinny-desktop 8f67ec7, element-call 3b0050e8.

**What happens** The topic editor's home-made markdown (src/app/features/common-settings/general/RoomProfile.tsx:56, 74-96) treats **any** single `_` or `*` as markdown. So ordinary topics get rewritten when saved: | Typed topic | Saved `formatted_body` | Saved plain `topic` (header + other clients) | |---|---|---| | `Rules: https://wiki.lotusguild.org/en/server_rules_and_faq` | `…/server<em>rules</em>and_faq` | `…/serverrulesand_faq` (**broken URL**) | | `[Our wiki](https://wiki.example.org/my_cool_page)` | `<a href="https://wiki.example.org/my<em>cool</em>page">` | `Our wiki` | | `Join #my_room_name:matrix.org` | `#my<em>room</em>name:…` | `#myroomname:…` (**wrong alias**) | (Reproduced by running the same functions in node.) **Why** - `MARKDOWN_PATTERN = /(\*\*|__|\*|_|~~|`|\[.+?\]\(.+?\))/` matches any single `_`. - The emphasis replacements run before, and inside, links and bare URLs. - The plain topic is derived by stripping tags, so the underscores are lost for good. - `"` isn't escaped, so `[x](https://a" onclick="…)` yields attribute injection in the stored `formatted_body`. It's sanitized when rendered, but it's still malformed HTML in room state that every client receives. **Fix ideas** - Use the composer's markdown pipeline (the same one messages use), or at least: - leave URLs and `#alias:server` / `@user:server` tokens alone; - require word boundaries for `_…_`; - escape `"`; - derive the plain `topic` from the user's original text, not from the stripped HTML. ### More context **Introduced by** 16a15efe (2026-06-01, "P0 post-deploy bug fixes"), the hand-rolled `topicMarkdownToHtml` / `buildTopicContent`. **Who:** anyone editing a room or space topic in Lotus. The damage is stored in room state, so **every member on every client** sees the broken link or alias. **Manual repro** 1. Room Settings → General → Edit, and set the topic to `Rules: https://wiki.lotusguild.org/en/server_rules_and_faq`. 2. Save, then look at the room header or open the room in Element. 3. **Actual:** the link reads `…/serverrulesand_faq` (and the formatted topic has `<em>` inside the URL). **Expected:** the URL is untouched. **Acceptance criteria** - URLs, `#alias:server` and `@user:server` survive verbatim in both `topic` and `formatted_body`. - `_`/`*` emphasis only at word boundaries. - `"` is escaped. - Unit tests for the three examples above. --- _Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny `30e2dbcd`, cinny-desktop `8f67ec7`, element-call `3b0050e8`._
jared added the bugpriority: mediumarea: settings labels 2026-10-04 17:41:25 -04:00
jared closed this issue 2026-10-19 14:41:04 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: settings bug priority: medium
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#262