[$500] Chat- HTML Reserved chars in workspace name gets decoded into string

[kbecciv]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Action Performed:

1. Go to the settings
2. Create or select a workspace and rename
3. Use encoded version of an html reserved char in the workspace name (eg. &Hello)
4. Go to the admin room of the workspace

Expected Result:

Rename system message should show encoded chars as in &Hello

Actual Result:

Reserved chars are decoded into message string in text field from BE &Hello

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android / native
• Android / Chrome
• iOS / native
• iOS / Safari
• MacOS / Chrome / Safari
• MacOS / Desktop

Version Number: 1.3.68.12
Reproducible in staging?: y
Reproducible in production?: y
If this was caught during regression testing, add the test name, ID and link from TestRail:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Notes/Photos/Videos: Any additional supporting documentation

Recording.4422.mp4

Expensify/Expensify Issue URL:
Issue reported by: @kursat
Slack conversation: https://expensify.slack.com/archives/C049HHMV9SM/p1694295351896949

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~01128899aae73e1cfd
• Upwork Job ID: 1701687382510047232
• Last Price Increase: 2023-10-03

[melvin-bot]

Triggered auto assignment to @johncschuster (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~01128899aae73e1cfd

[melvin-bot]

Bug0 Triage Checklist (Main S/O)

• This "bug" occurs on a supported platform (ensure Platforms in OP are ✅)
• This bug is not a duplicate report (check E/App issues and #expensify-bugs)
  • If it is, comment with a link to the original report, close the issue and add any novel details to the original issue instead
• This bug is reproducible using the reproduction steps in the OP. S/O
  • If the reproduction steps are clear and you're unable to reproduce the bug, check with the reporter and QA first, then close the issue.
  • If the reproduction steps aren't clear and you determine the correct steps, please update the OP.
• This issue is filled out as thoroughly and clearly as possible
  • Pay special attention to the title, results, platforms where the bug occurs, and if the bug happens on staging/production.
• I have reviewed and subscribed to the linked Slack conversation to ensure Slack/Github stay in sync

[melvin-bot]

Triggered auto assignment to @anmurali (External), see https://stackoverflow.com/c/expensify/questions/8582 for more details.

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @thesahindia (External)

[salonikumawat28]

[Updated] Proposal

Please re-state the problem that we are trying to solve in this issue.

HTML Reserved chars in workspace name gets decoded into string

What is the root cause of that problem?

Workspace name &Hello is coming incorrect from BE as &Hello in text field. In html field, its coming correctly as &Hello.

Ideally this name should be displayed as text and not html but because of below logic, it's shown as HTML:

App/src/pages/home/report/ReportActionItemFragment.js

Lines 120 to 132 in 10ad0cb

	// If the only difference between fragment.text and fragment.html is <br /> tags
	// we render it as text, not as html.
	// This is done to render emojis with line breaks between them as text.
	const differByLineBreaksOnly = Str.replaceAll(html, '<br />', '\n') === text;
	// Only render HTML if we have html in the fragment
	if (!differByLineBreaksOnly) {
	const isPendingDelete = props.pendingAction === CONST.RED_BRICK_ROAD_PENDING_ACTION.DELETE && props.network.isOffline;
	const editedTag = props.fragment.isEdited ? `<edited ${isPendingDelete ? 'deleted' : ''}></edited>` : '';
	const htmlContent = applyStrikethrough(html + editedTag, isPendingDelete);
	return <RenderHTML html={props.source === 'email' ? `<email-comment>${htmlContent}</email-comment>` : `<comment>${htmlContent}</comment>`} />;
	}

What changes do you think we should make in order to solve the problem?

Solution 1:

If we can make changes in BE, we should send either html or text field.

Solution 2:

If solution 1 can't be immediately done in BE, intermediary solution is as following:

1. If html is present and canTreatAsText(html) is false, render as html.
2. If canTreatAsText(html) is false, render html as text.
3. If html is not present, render as 'text'.

Here canTreatAsText(html) is something similar to:

function canTreatAsText(html) {
  // Function to check if HTML content has non-escaped HTML tags
  const hasNonEscapedTags = (str) => /<[^>]+>/g.test(str);

  // Function to check if HTML content has escaped HTML tags
  const hasEscapedTags = (str) => /&lt;[^&]+&gt;/g.test(str);

  // Check if the HTML content has non-escaped HTML tags
  if (hasNonEscapedTags(html)) {
    return false;
  }

  // Check if the HTML content has escaped HTML tags
  if (hasEscapedTags(html)) {
    return true;
  }

  // If neither non-escaped nor escaped HTML tags are found, treat it as plain text
  return true;
}

// Test case
let htmlContent = '<p>&lt;p&gt;This is an escaped paragraph.&lt;/p&gt;</p>';
console.log(canTreatAsText(htmlContent)); // false (non-escaped HTML tags)

htmlContent = '&lt;p&gt;This is an escaped paragraph.&lt;/p&gt;&amp;hello';
console.log(canTreatAsText(htmlContent)); // true (escaped HTML tags)

htmlContent = 'This is a plain text';
console.log(canTreatAsText(htmlContent)); // true (plain text)

Applying this solution, we can see the &hello properly now.

What alternative solutions did you explore? (Optional)

Issue-27291-Solution-1.mp4

[melvin-bot]

📣 @salonikumawat28! 📣
Hey, it seems we don’t have your contributor details yet! You'll only have to do this once, and this is how we'll hire you on Upwork.
Please follow these steps:

1. Get the email address used to login to your Expensify account. If you don't already have an Expensify account, create one here. If you have multiple accounts (e.g. one for testing), please use your main account email.
2. Get the link to your Upwork profile. It's necessary because we only pay via Upwork. You can access it by logging in, and then clicking on your name. It'll look like this. If you don't already have an account, sign up for one here.
3. Copy the format below and paste it in a comment on this issue. Replace the placeholder text with your actual details.
   
   Format:

Contributor details
Your Expensify account email: <REPLACE EMAIL HERE>
Upwork Profile Link: <REPLACE LINK HERE>