Need to see what can be done in Remarkup syntax and what need to be escaped.
"Classic" escape (sanitize html tags) should already be done by phab itself.
Description
Description
Event Timeline
Comment Actions
Hello @Aklapper. Github-notif-bot will add comments to phab tasks like what currently does @gerritbot. I wonder if I need to escape the fields present in this comment. Can a problematic action be made using the comment field in phabricator tasks, voluntarily or not ? I only see adding subscribers by mentioning them.
Comment Actions
I don't know. What are "fields in a comment" exactly? That's a question for @gerritbot maintainers probably?
Comment Actions
The comment itself. Imagine that anyone could write a text that would be posted as a comment of a phabricator task, like what @gerritbot already does. Do you see any particular syntax that might be problematic, and so should be sure it's removed?
Looking at https://secure.phabricator.com/book/phabricator/article/remarkup/ I found nothing put in a comment box that might cause a problem.