Unify the HTML encoding handling with other ROS apps

[nickvergessen]

While looking into nextcloud/android#3487 I noticed, that the apps which use the most famous RichObjectStrings (Activity and Notifications) have an inconsistent handling in terms of HTML encoding. Or to phrase it better, neither cared and it worked for most, because the providing app happened to escape the HTML (sometimes).

So now we simply define, that ROS should not be HTML escaped, similar to their plain-text variants. Instead the viewing part is responsible to escape the HTML properly, which was provided before the ROS rendering happens.

⚠️ The rendering PRs below need to be merged/backported before, otherwise we create a stored XSS in the comments app. ⚠️

• Unify the HTML encoding handling with other ROS apps notifications#261
• Unify the HTML encoding handling with other ROS apps  activity#343

I checked all apps, and I only could find HTML handling in comments (for activities only, notifications are fine) and announcementcenter (both fixed for upcoming)

---

Client devs please confirm that this works as intended on your side then:

• Desktop: @camilasan
• Android: @tobiasKaminsky @AndyScherzinger
• iOS: @marinofaggiana

You can test this, by mentioning your user @test1 in a comment:

@test1 <strong>this should not be bold</strong>
This is on a new line

<em>And this is two lines away and NOT italic</em>

[tobiasKaminsky]

As mentioned on IRC, this is working on Android.
But as soon as I enable this PR, I do get html tags parsed after a refresh of the web site:

• open details on any file
• enter a comment with html tag
• see that they are not parsed
• refresh site
• see html tags parsed, e.g. text is bold

[nickvergessen]

Which is expected as per the bold warning in the PR description

[tobiasKaminsky]

Hm. I assumed that if I enable all three PRs, that then everything would work…
Then sorry for the noise ;-)

[marinofaggiana]

Sure, no problem !

[rullzer]

@nickvergessen so since we only have notifications on the client. We'd need to validate that we escape the html right?

[nickvergessen]

@rullzer yeah basically make sure all HTML is shown as plain text <strong>.
Markup should only be done via the Rich message stuff.

[rullzer]

I'll try to verify this evening then

[rullzer]

Properly escaped on desktop.,