Skip to content

fix: fix script tag quot escaped #37296

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
awais786 merged 2 commits into from
Aug 28, 2025
Merged

fix: fix script tag quot escaped #37296

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
527fba5
fix: fix script tag quot escaped
mubbsharanwar Aug 28, 2025
1b65a8c
Merge branch 'master' into mubbsharanwar/fix-script-quot
awais786 Aug 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion lms/djangoapps/discussion/rest_api/discussions_notifications.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
Discussion notifications sender util.
"""
import re
import html

from bs4 import BeautifulSoup, Tag
from django.conf import settings
Expand Down Expand Up @@ -447,7 +448,9 @@ def clean_thread_html_body(html_body):
"""
Get post body with tags removed and limited to 500 characters
"""
html_body = BeautifulSoup(Truncator(html_body).chars(500, html=True), 'html.parser')
truncated_body = Truncator(html_body).chars(500, html=True)
Copy link
Contributor Author

@mubbsharanwar mubbsharanwar Aug 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Truncator escapes quotes to encoding, match.unwrap() escapes it again and in this way string was escaping two times, that's why we are unescaping here.

truncated_body = html.unescape(truncated_body)
html_body = BeautifulSoup(truncated_body, 'html.parser')

tags_to_remove = [
"a", "link", # Link Tags
Expand Down
12 changes: 5 additions & 7 deletions lms/djangoapps/discussion/rest_api/tests/test_discussions_notifications.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@
Unit tests for the DiscussionNotificationSender class
"""
import re
import django
import unittest
from unittest.mock import MagicMock, patch

Expand Down Expand Up @@ -109,13 +108,12 @@ def test_html_tags_removal(self):
<p>Script test: <script>alert("hello");</script></p>
<p>Some other content that should remain.</p>
"""
excepted_script_quot = 'alert(&amp;quot;hello&amp;quot;);' if django.VERSION >= (5, 0) else 'alert("hello");'
expected_output = (
f'<p style="margin: 0">This is a link to a page.</p>'
f'<p style="margin: 0">Here is an image: </p>'
f'<p style="margin: 0">Embedded video: </p>'
f'<p style="margin: 0">Script test: {excepted_script_quot}</p>'
f'<p style="margin: 0">Some other content that should remain.</p>'
'<p style="margin: 0">This is a link to a page.</p>'
'<p style="margin: 0">Here is an image: </p>'
'<p style="margin: 0">Embedded video: </p>'
'<p style="margin: 0">Script test: alert("hello");</p>'
'<p style="margin: 0">Some other content that should remain.</p>'
)

result = clean_thread_html_body(html_body)
Expand Down
Loading