RocketChat / RocketChat/Rocket.Chat

Inconsistent HTML escaping in web and mobile

Open
#29,448 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

message rendering type: bug type: improvement
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

When submitting messages that contain Markdown syntax and HTML special symbols via incoming webhooks, the message formatting behavior seems inconsistent between the web and mobile apps. Example payload:

{
  "attachments": [
    {
      "fields": [
				{
				"title":"Title Goes Here",
				"value":"a>b `a>b`"
				}
			]
    }
  ]
}

In the web app, this gets rendered as:

image

In the mobile app:

image

On web, the right angle bracket inside backticks gets rendered replaced with >. On mobile, it is shown as-is.

Steps to reproduce:
  1. Create an incoming webhook
  2. Submit the above payload to the webhook
  3. Observe the results
Expected behavior:

The web and mobile apps should behave the same. The behavior (Precisely what markdown syntax in which fields is supported. Precisely what HTML syntax in which fields is supported. What is the escaping logic for unsupported syntax) should be documented.

Actual behavior:

In the web app, this gets rendered as:

image

In the mobile app:

image

Server Setup Information:
  • Version of Rocket.Chat Server: tested with the SaaS versions of Rocket.Chat, running 6.2.2
Client Setup Information
  • Desktop App or Browser Version: tested with the SaaS versions of Rocket.Chat, running 6.2.2
  • Mobile App: installed from Google Play, v4.38.0

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the provided incoming webhook payload and compare its rendering in the web and mobile apps, focusing on Markdown and HTML escaping. Done means both clients render the example consistently, with the supported Markdown and HTML behavior and escaping rules documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
markdown, typescript
Domain
api, frontend, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.