全名中的引号弄乱了引用 markdown

RGJ · 2025年十二月12日 15:54

禁用“在用户体验中优先显示用户名”
启用“在帖子中显示昵称”
有一个名字中带有引用的用户
尝试引用他们

Teafh · 2025年十二月12日 16:09

这是一个 Contribute > Feature

zogstrip · 2025年十二月12日 17:49

恐怕没有

最简单和最安全的方法是删除它们，虽然不理想，但总比弄坏了要好？

github.com/discourse/discourse

FIX: strip quotation marks from names in quote BBCode

main ← strip-quotation-marks-from-names-in-quote-bbcode

opened 05:48PM - 12 Dec 25 UTC

ZogStriP

+31 -2

When "display name on posts" is enabled and "prioritize username in UX" is disab…led, quoting a user with quotation marks in their display name (e.g., `John "The Dev" Smith`) breaks the quote markdown: [quote="John "The Dev" Smith, post:1, topic:2"] The BBCode parser's regex `"([^"]+)"` stops at the first `"` inside the name, capturing only `John ` instead of the full name. Alternatives considered: - Backslash escaping (`\"`): Would require updating the parser regex to support escape sequences and adding unescape logic. Adds complexity and risks breaking existing quotes. - URL encoding (`%22`): Requires decoding when rendering. Using `decodeURIComponent` on user input creates XSS risk. A safe decoder that only decodes specific characters adds complexity and attack surface for minimal benefit. The simplest solution is to strip quotation marks from names when building the quote BBCode. This is safe (no user input decoding), simple (no parser changes), and the minor cosmetic loss in the quote attribution is an acceptable trade-off. The `stripQuotationMarks` function is defined alongside the existing `QUOTATION_MARKS` array in bbcode-block.js to keep related logic together and avoid duplication. Ref - https://meta.discourse.org/t/391153

RGJ · 2025年十二月12日 17:54

哇，真快谢谢！

話題		回覆	觀看
Quoting broken when name matches username Bug	20	2114	2022年四月26日
Display full name not username when attributing quote in RTE Bug composer	15	348	2026年二月26日
[quote] loses backslashes on this super edge case Bug markdown-it-review	3	1182	2017年六月26日
Can a Theme have a quote display real name instead of username? Feature	1	726	2018年二月13日
"display name on posts" should apply to quotes, too Feature	1	494	2026年二月25日

全名中的引号弄乱了引用 markdown

相關主題