User Titles with “special symbols” appear to be glitched

Contribute Bug

AI-generated summary

A user, twofoursixeight, reported an issue with user titles containing special symbols (e.g., ’ or ") displaying incorrectly in the settings menu. supermathie suggested that the issue might be related to smartquotes and character encoding. The problem was reproduced by awesomerobot, who found that the apostrophe character (') is specifically affected, while other characters like ˮ or « work properly. sam acknowledged the issue and noted that it is likely related to security measures to prevent script injection, but a careful fix is needed to avoid introducing an XSS vulnerability. The issue has been marked as #pr-welcome, but developers are advised to exercise caution when implementing a solution.

1

image
image465×120 10.1 KB

So if your title has a special symbol like ’ or ", then they will display weird stuff in the settings menu. It will be quite glitched.
“The title should say Owner’s Pet.”

2

Those would be smartquotes.

In which settings menu does it show like this?

The “glitchy” representations are the percent-encoded versions of those… possibly in the wrong codepage and not UTF-8?

Can you duplicate the problem here or on try?

1 Like
3

It shows up in Settings >> Preferences.

I don’t have any custom titles with smartquotes either. It cannot be tested on Try or Meta. Therefore it cannot be tested.

4

Oh! User titles. I was thinking topic titles.

image

this is: Person’s “title”

@twofoursixeight can you copy the actual title string into a post here?

1 Like
5

I can repro

Screenshot 2023-05-30 at 12.10.28 PM
Screenshot 2023-05-30 at 12.10.28 PM273×154 3.19 KB

in this case it’s the apostrophe character, ' (hex ')

Seems like other characters work properly, I tried a few others like ˮ or « and those were fine :man_shrugging:

5 Likes
6

This is going to be related to our security measures and ensuring there is no chance for script injection.

I am sure there is a straight forward fix, but surface area is quite big and we would need very careful testing to ensure that an XSS is not introduced with the fix.

Going to put pr-welcome on this for now, but whoever takes this please be extra careful to prove your change does not introduce an XSS vector.

5 Likes