Page MenuHomePhabricator

Incorrect handling of TemplateStyles in Editnotices
Closed, ResolvedPublicBUG REPORT

Description

Steps to reproduce

  1. Go to any protected page in the Android App while logged out
  2. Attempt to edit, and look at the displayed edit notice

Expected results

The editnotice displays the correctly styled editnotice, or failing that strips all styling from the editnotice

Actual results

The editnotice displays the raw TemplateStyles css in the editnotice

Screenshot_20220601-081522_Wikipedia.jpg (2×1 px, 583 KB)

Environments observed

App version: 2.7.50401-r-2022-05-09
Android OS versions: 12
Device model: Galaxy A52s
Device language: Dutch

Event Timeline

Dbrant subscribed.

We use the VisualEditor API to get the text of the edit notices, and I believe VisualEditor in turn uses Parsoid to parse the notices (and TemplateStyles isn't compatible with Parsoid yet, if I understand correctly). Therefore tagging Parsoid.

Here is an API call to visualeditor that will produce the same results (under the permissions-error notice):
https://en.wikipedia.org/w/api.php?format=json&formatversion=2&errorformat=html&action=visualeditor&paction=metadata&page=Barack_Obama

TemplateStyles is compatible with Parsoid. This may be an edge case / bug. We will have to take a look.

We use the VisualEditor API to get the text of the edit notices, and I believe VisualEditor in turn uses Parsoid to parse the notices (and TemplateStyles isn't compatible with Parsoid yet, if I understand correctly). Therefore tagging Parsoid.

Here is an API call to visualeditor that will produce the same results (under the permissions-error notice):
https://en.wikipedia.org/w/api.php?format=json&formatversion=2&errorformat=html&action=visualeditor&paction=metadata&page=Barack_Obama

Debugging tip: I needed to open this link as an anon editor (while logged out) to see the notice.

If i save the notice in a HTML file and open it in my browser, it renders just fine. Can you clarify what problem you see there? https://en.wikipedia.org/wiki/Barack_Obama?veaction=edit (opened while logged out) also displays the notice just fine.

So, I suspect something is broken in the handling of the API results. Can you verify / clarify?

I'd guess the app is doing some kind of HTML filtering/sanitization to keep links but remove things like templates, and that doesn't work as epected. A common error is using Node.textContent or equivalent functionality instead of HTMLElement.innerText (which correctly removes the content of invisible tags like <style> when converting to text).

Whoops, sorry about that: looking a little closer at the API response, it looks like the HTML is in fact formatted properly, but the native Android text parser doesn't know what to do with <style> tags, and treats them as plain text.
We'll take care of it on our end.