Html comments are shown in PR and issue descriptions

[viceice]

Description

Since v1.16.5 Html comments are shown in PR and issue descriptions, they should be hidden as before.

Reproducer: https://try.gitea.io/viceice/test/issues/1

Gitea Version

1.16.5

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

Git Version

No response

Operating System

No response

How are you running Gitea?

Official helm chart with slim image

Database

PostgreSQL

[viceice]

It seems < is encoded as \x3C 🤔

[xoxys]

As discussed in the chat:

gitea on  HEAD (e6d46ee) (BISECTING) [$] via 🐹 v1.16.15 via  v16.14.0 took 8s 
❯ git bisect good
f9ea4ab69ae397be4791c2e2ebf59f6cd9e5a6f8 is the first bad commit
commit f9ea4ab69ae397be4791c2e2ebf59f6cd9e5a6f8
Author: techknowlogick <techknowlogick@gitea.io>
Date:   Sat Mar 19 13:46:47 2022 -0400

[viceice]

maybe the github.com/yuin/goldmark v1.4.0 to v1.4.8 update?

[viceice]

I think this is fixed in a later version

• Regression 1.4.7 -> 1.4.8 (html.WithUnsafe) yuin/goldmark#285
• yuin/goldmark@e64a68f
• https://github.com/yuin/goldmark/releases/tag/v1.4.9

[xoxys]

Should be a quick fix in this case.

[viceice]

When can i expect a fixed gitea version? If it needs some days i would create a small jquery script on page load to fix it temporary

[xoxys]

Don't know, one of the maintainers could give us a rough timeline.

[viceice]

Just ask if it's worth to create the quickfix 🙃

[xoxys]

Can confirm that updating goldmark fixes the issue:

❯ docker run -v $(pwd):/drone/src --workdir /drone/src -it golang:1.18 bash
root@c5219c2fabbe:/drone/src# go get -u github.com/yuin/goldmark
go: downloading github.com/yuin/goldmark v1.4.11
go: upgraded github.com/yuin/goldmark v1.4.8 => v1.4.11
root@c5219c2fabbe:/drone/src# TAGS="bindata sqlite sqlite_unlock_notify" make build

So you could build it with the fixed version from the release/v1.16 branch on your own.

[viceice]

OK, thanks. Will do a jQuery quickfix for now. It's easier, as i already have a custom js file embedded. 😉

$('.task-list-item').contents().each((i, e) => {
  if (e.nodeName === '#text') {
    e.textContent = e.textContent.replaceAll(/\x3C!--.*?-->/g, '')
  }
})