From 0c221943ef588df195a0e36da4d95e164e3094f2 Mon Sep 17 00:00:00 2001
From: lain <lain@soykaf.club>
Date: Sat, 21 Apr 2018 18:24:45 +0200
Subject: [PATCH] Formatter: Use proper escaping for links.

---
 lib/pleroma/formatter.ex |  7 +++++--
 test/formatter_test.exs  | 21 ++++++++++++++-------
 2 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/lib/pleroma/formatter.ex b/lib/pleroma/formatter.ex
index 515909af1..a708a275e 100644
--- a/lib/pleroma/formatter.ex
+++ b/lib/pleroma/formatter.ex
@@ -144,7 +144,7 @@ defmodule Pleroma.Formatter do
     @emoji
   end
 
-  @link_regex ~r/https?:\/\/[\w\.\/?=\-#\+%&@~\(\):]+[\w\/]/u
+  @link_regex ~r/https?:\/\/[\w\.\/?=\-#\+%&@~'\(\):]+[\w\/]/u
 
   def html_escape(text) do
     Regex.split(@link_regex, text, include_captures: true)
@@ -168,7 +168,10 @@ defmodule Pleroma.Formatter do
     subs =
       subs ++
         Enum.map(links, fn {uuid, url} ->
-          {uuid, "<a href='#{url}'>#{url}</a>"}
+          {:safe, link} = Phoenix.HTML.Link.link(url, to: url)
+          link = link
+          |> IO.iodata_to_binary
+          {uuid, link}
         end)
 
     {subs, uuid_text}
diff --git a/test/formatter_test.exs b/test/formatter_test.exs
index 4c65b26f2..2cf1f3f8e 100644
--- a/test/formatter_test.exs
+++ b/test/formatter_test.exs
@@ -23,21 +23,21 @@ defmodule Pleroma.FormatterTest do
       text = "Hey, check out https://www.youtube.com/watch?v=8Zg1-TufF%20zY?x=1&y=2#blabla."
 
       expected =
-        "Hey, check out <a href='https://www.youtube.com/watch?v=8Zg1-TufF%20zY?x=1&y=2#blabla'>https://www.youtube.com/watch?v=8Zg1-TufF%20zY?x=1&y=2#blabla</a>."
+        "Hey, check out <a href=\"https://www.youtube.com/watch?v=8Zg1-TufF%20zY?x=1&amp;y=2#blabla\">https://www.youtube.com/watch?v=8Zg1-TufF%20zY?x=1&amp;y=2#blabla</a>."
 
       assert Formatter.add_links({[], text}) |> Formatter.finalize() == expected
 
       text = "https://mastodon.social/@lambadalambda"
 
       expected =
-        "<a href='https://mastodon.social/@lambadalambda'>https://mastodon.social/@lambadalambda</a>"
+        "<a href=\"https://mastodon.social/@lambadalambda\">https://mastodon.social/@lambadalambda</a>"
 
       assert Formatter.add_links({[], text}) |> Formatter.finalize() == expected
 
       text = "https://mastodon.social:4000/@lambadalambda"
 
       expected =
-        "<a href='https://mastodon.social:4000/@lambadalambda'>https://mastodon.social:4000/@lambadalambda</a>"
+        "<a href=\"https://mastodon.social:4000/@lambadalambda\">https://mastodon.social:4000/@lambadalambda</a>"
 
       assert Formatter.add_links({[], text}) |> Formatter.finalize() == expected
 
@@ -47,28 +47,35 @@ defmodule Pleroma.FormatterTest do
       assert Formatter.add_links({[], text}) |> Formatter.finalize() == expected
 
       text = "http://www.cs.vu.nl/~ast/intel/"
-      expected = "<a href='http://www.cs.vu.nl/~ast/intel/'>http://www.cs.vu.nl/~ast/intel/</a>"
+      expected = "<a href=\"http://www.cs.vu.nl/~ast/intel/\">http://www.cs.vu.nl/~ast/intel/</a>"
 
       assert Formatter.add_links({[], text}) |> Formatter.finalize() == expected
 
       text = "https://forum.zdoom.org/viewtopic.php?f=44&t=57087"
 
       expected =
-        "<a href='https://forum.zdoom.org/viewtopic.php?f=44&t=57087'>https://forum.zdoom.org/viewtopic.php?f=44&t=57087</a>"
+        "<a href=\"https://forum.zdoom.org/viewtopic.php?f=44&amp;t=57087\">https://forum.zdoom.org/viewtopic.php?f=44&amp;t=57087</a>"
 
       assert Formatter.add_links({[], text}) |> Formatter.finalize() == expected
 
       text = "https://en.wikipedia.org/wiki/Sophia_(Gnosticism)#Mythos_of_the_soul"
 
       expected =
-        "<a href='https://en.wikipedia.org/wiki/Sophia_(Gnosticism)#Mythos_of_the_soul'>https://en.wikipedia.org/wiki/Sophia_(Gnosticism)#Mythos_of_the_soul</a>"
+        "<a href=\"https://en.wikipedia.org/wiki/Sophia_(Gnosticism)#Mythos_of_the_soul\">https://en.wikipedia.org/wiki/Sophia_(Gnosticism)#Mythos_of_the_soul</a>"
 
       assert Formatter.add_links({[], text}) |> Formatter.finalize() == expected
 
       text = "https://www.google.co.jp/search?q=Nasim+Aghdam"
 
       expected =
-        "<a href='https://www.google.co.jp/search?q=Nasim+Aghdam'>https://www.google.co.jp/search?q=Nasim+Aghdam</a>"
+        "<a href=\"https://www.google.co.jp/search?q=Nasim+Aghdam\">https://www.google.co.jp/search?q=Nasim+Aghdam</a>"
+
+      assert Formatter.add_links({[], text}) |> Formatter.finalize() == expected
+
+      text = "https://en.wikipedia.org/wiki/Duff's_device"
+
+      expected =
+        "<a href=\"https://en.wikipedia.org/wiki/Duff&#39;s_device\">https://en.wikipedia.org/wiki/Duff&#39;s_device</a>"
 
       assert Formatter.add_links({[], text}) |> Formatter.finalize() == expected
     end