encode special characters on some error pages (#35492) (#35652)

Automatic Merge

server/channels/utils/api_test.go

@@ -14,12 +14,14 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/public/shared/i18n"
 )
 
 func TestRenderWebError(t *testing.T) {
@@ -49,3 +51,44 @@ func TestRenderWebError(t *testing.T) {
 	h := sha256.Sum256([]byte("/error?foo=bar"))
 	assert.True(t, ecdsa.Verify(&key.PublicKey, h[:], rs.R, rs.S))
 }
+
+func TestRenderMobileError(t *testing.T) {
+	require.NoError(t, i18n.TranslationsPreInitFromFileBytes("en.json", []byte(`[{"id":"api.back_to_app","translation":"Back to {{.SiteName}}"}]`)))
+
+	cfg := &model.Config{}
+	cfg.SetDefaults()
+	*cfg.ServiceSettings.SiteURL = "http://localhost:8065"
+	*cfg.TeamSettings.SiteName = "Mattermost<test>"
+	cfg.NativeAppSettings.AppCustomURLSchemes = []string{"mattermost"}
+
+	appErr := model.NewAppError("test", "api.test.error", nil, "details", http.StatusBadRequest)
+	appErr.Message = "Something went <wrong>"
+
+	t.Run("renders html with special characters encoded in site name", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		RenderMobileError(cfg, w, appErr, "mattermost://auth/complete")
+
+		body := w.Body.String()
+		assert.Equal(t, http.StatusOK, w.Code)
+		assert.Contains(t, body, "Mattermost&lt;test&gt;")
+		assert.NotContains(t, body, "Mattermost<test>")
+	})
+
+	t.Run("renders html with special characters encoded in error message", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		RenderMobileError(cfg, w, appErr, "mattermost://auth/complete")
+
+		body := w.Body.String()
+		assert.Contains(t, body, "Something went &lt;wrong&gt;")
+		assert.NotContains(t, body, "Something went <wrong>")
+	})
+
+	t.Run("falls back to site url for invalid redirect scheme", func(t *testing.T) {
+		w := httptest.NewRecorder()
+		RenderMobileError(cfg, w, appErr, "https://evil.example.com/callback")
+
+		body := w.Body.String()
+		assert.Contains(t, body, "http://localhost:8065")
+		assert.False(t, strings.Contains(body, "evil.example.com"))
+	})
+}