[$500] Web - Task - Task title starting with “<<<test” and the word “test” is not displayed in the chat.

[kbecciv]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number: 1.4.1.5
Reproducible in staging?: y
Reproducible in production?: y
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Expensify/Expensify Issue URL:
Issue reported by: Applause - Internal Team
Slack conversation:

Action Performed:

1. Open a chat.
2. Go to the "Assign task" section.
3. Create a task by entering a title with the format “<<<Test.”
4. Now, go back to the chat.

Expected Result:

The word "Test" should be displayed in the chat if the title starts with “<<<”.

Actual Result:

Task title starting with “<<<test,” and the word “test” is not displayed in the chat.

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android: Native
• Android: mWeb Chrome
• iOS: Native
• iOS: mWeb Safari
• MacOS: Chrome / Safari
• MacOS: Desktop

Screenshots/Videos

Add any screenshot/video evidence

Bug6285413_1700569102911.2023-11-21_17-09-07.mp4

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~0158ca9e1d4c5abb0b
• Upwork Job ID: 1726987274682650624
• Last Price Increase: 2023-11-21
• Automatic offers:
• FitseTLT | Contributor | 27887201

[melvin-bot]

Triggered auto assignment to @MitchExpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~0158ca9e1d4c5abb0b

[melvin-bot]

Bug0 Triage Checklist (Main S/O)

• This "bug" occurs on a supported platform (ensure Platforms in OP are ✅)
• This bug is not a duplicate report (check E/App issues and #expensify-bugs)
  • If it is, comment with a link to the original report, close the issue and add any novel details to the original issue instead
• This bug is reproducible using the reproduction steps in the OP. S/O
  • If the reproduction steps are clear and you're unable to reproduce the bug, check with the reporter and QA first, then close the issue.
  • If the reproduction steps aren't clear and you determine the correct steps, please update the OP.
• This issue is filled out as thoroughly and clearly as possible
  • Pay special attention to the title, results, platforms where the bug occurs, and if the bug happens on staging/production.
• I have reviewed and subscribed to the linked Slack conversation to ensure Slack/Github stay in sync

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @thesahindia (External)

[FitseTLT]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Task title starting with “<<<test” and the word “test” is not displayed in the chat.

What is the root cause of that problem?

We are not escaping the task title here

App/src/components/ReportActionItem/TaskPreview.js

Lines 91 to 94 in a722235

	const htmlForTaskPreview =
	taskAssignee && taskAssigneeAccountID !== 0
	? `<comment><mention-user accountid="${taskAssigneeAccountID}">@${taskAssignee}</mention-user> ${taskTitle}</comment>`
	: `<comment>${taskTitle}</comment>`;

so it is considering < in the task title as part of the html as we pass it to the html renderer

What changes do you think we should make in order to solve the problem?

We should escape task title because we are rendering it as html

App/src/components/ReportActionItem/TaskPreview.js

Line 86 in a722235

const taskTitle = props.taskReport.reportName || props.action.childReportName;

 const taskTitle = _.escape(props.taskReport.reportName || props.action.childReportName);

What alternative solutions did you explore? (Optional)

[BhuvaneshPatil]

Proposal

Please re-state the problem that we are trying to solve in this issue.

When we add title that has <<< at the starting doesn't show full title

What is the root cause of that problem?

< characters are part of HTML syntax and when we render the task preview, it parses the string to HTML and as the task name is not valid html, we are seeing the error.

What changes do you think we should make in order to solve the problem?

We should encode the HTML before rendering it. Example - < becomes &lt

App/src/components/ReportActionItem/TaskPreview.js

Line 127 in 689338c

<RenderHTML html={htmlForTaskPreview} />

By using

    const taskTitle = Str.htmlEncode(props.taskReport.reportName || props.action.childReportName);

We will encode the title, and whenever it's being shown in the TaskPreview will be encoded. And it needs to be encoded in TaskPreview because we are showing it as HTML content using RenderHTML

What alternative solutions did you explore? (Optional)

[vjurcutiu]

This may be a security concern. If there's someone I can DM about this, let me know.

[MitchExpensify]

@vjurcutiu can you let @mountiny know your concern in DM please?