LotusGuild/cinny
3
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Status banner Details mangles announcement text: every >, #, _, *, ` is deleted ("#general" → "general", "<b>" → "<b") #308

New Issue
Closed
opened 2026-10-04 23:53:35 -04:00 by jared · 0 comments
jared commented 2026-10-04 23:53:35 -04:00
Owner
Copy Link
Copy Source

The Details line of a Kuma maintenance or announcement strip goes through plain() in src/app/utils/kumaStatus.ts:

.replace(/[*_`#>]/g, '')

This removes those characters everywhere, not just where they are Markdown syntax. Rendered with Playwright from an incident whose content was Read the <b>guide</b> <img src=x onerror=alert(1)> # Heading\n* item one:

Read the <bguide</b <img src=x onerror=alert(1) Heading | item one

React escapes it, so this isn't an injection, but the text is wrong in ordinary announcements:

  • room aliases and channels: "join #lotus-general" → "join lotus-general"; #announcements:lotusguild.org loses its #;
  • names: snake_case, @some_user, URLs with underscores, "C#";
  • arrows and comparisons: "calls -> fixed" → "calls - fixed", "> 5 people";
  • inline code: `/sfu/get` loses its backticks, which is fine, but 5 * 3 becomes "5 3".

Fix: strip only Markdown syntax: leading #{1,6} / > / * ·- list markers at line start, paired **x**/*x*/_x_/`x`, and decode or strip HTML tags with a DOM-free regex like <\/?[a-z][^>]*>. Alternatively, render a small safe Markdown subset in Details. Add unit cases for #room:server, snake_case, ->, and a heading and list.

Everything else in the banner checked out in this pass, on desktop and on a Pixel 7 viewport:

  • the maintenance strip with "until 12:31 AM" and Details/Hide;
  • a long announcement that wraps without horizontal scroll;
  • dismiss surviving a reload, and the strip coming back when the incident is edited;
  • the calls-down strip, plus the Join note "Voice calls are down right now, so joining may fail.";
  • "server is having problems" while sync is OK;
  • the login-screen strips for server down (role=alert) and sign-in down.

Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny 30e2dbcd, cinny-desktop 8f67ec7, element-call 3b0050e8.

The Details line of a Kuma maintenance or announcement strip goes through `plain()` in `src/app/utils/kumaStatus.ts`: ```ts .replace(/[*_`#>]/g, '') ``` This removes those characters **everywhere**, not just where they are Markdown syntax. Rendered with Playwright from an incident whose content was `Read the <b>guide</b> <img src=x onerror=alert(1)> # Heading\n* item one`: ``` Read the <bguide</b <img src=x onerror=alert(1) Heading | item one ``` React escapes it, so this isn't an injection, but the text is wrong in ordinary announcements: - room aliases and channels: "join #lotus-general" → "join lotus-general"; `#announcements:lotusguild.org` loses its `#`; - names: `snake_case`, `@some_user`, URLs with underscores, "C#"; - arrows and comparisons: "calls -> fixed" → "calls - fixed", "> 5 people"; - inline code: `` `/sfu/get` `` loses its backticks, which is fine, but `5 * 3` becomes "5 3". **Fix:** strip only Markdown syntax: leading `#{1,6} ` / `> ` / `* `·`- ` list markers at line start, paired `**x**`/`*x*`/`_x_`/`` `x` ``, and decode or strip HTML tags with a DOM-free regex like `<\/?[a-z][^>]*>`. Alternatively, render a small safe Markdown subset in Details. Add unit cases for `#room:server`, `snake_case`, `->`, and a heading and list. Everything else in the banner checked out in this pass, on desktop and on a Pixel 7 viewport: - the maintenance strip with "until 12:31 AM" and Details/Hide; - a long announcement that wraps without horizontal scroll; - dismiss surviving a reload, and the strip coming back when the incident is edited; - the calls-down strip, plus the Join note "Voice calls are down right now, so joining may fail."; - "server is having problems" while sync is OK; - the login-screen strips for server down (`role=alert`) and sign-in down. --- _Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny `30e2dbcd`, cinny-desktop `8f67ec7`, element-call `3b0050e8`._
jared added the bugpriority: lowarea: notifications labels 2026-10-04 23:53:35 -04:00
jared closed this issue 2026-10-18 01:33:18 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: notifications bug priority: low
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#308