zulip / zulip-mobile / 3544 / 1

47%

master: 47%

push

travis-ci

webview html: Treat match_subject as HTML (fix #2845).

The `subject` field is plain text, and we need to treat it as such.
Until 994145383 "webview: Escape *everything* that isn't intended as HTML",
we treated it as HTML, and that caused a serious bug (a potential
security vulnerability) in the case where another user sent a message
whose topic (aka subject) happened to contain HTML metacharacters.

On the other hand when we do a search, the `match_subject` field marks
up the subject with HTML to describe how to highlight matching terms.
Currently we treat `match_subject` just like `subject`, so we end up
treating that HTML as text and re-encoding it as HTML.

Fortunately, the server correctly handles the interaction of `subject`
being text and `match_subject` needing to use HTML, in that before
marking up the topic, it encodes it (*) as HTML.  So, we can simply
take `match_subject` as the HTML to display.

(*) Except in a certain case which we never exercise; see zulip/zulip#10588 .

Fixes #2845.

1014 of 2104 branches covered (48.19%)

Branch coverage included in aggregate %.

1960 of 3803 relevant lines covered (51.54%)

49.96 hits per line