Fallback to feed item description does not strip HTML, only takes 40 chars even though field allows 255

Added screenshot of problems and expanded proposed resolution. Ended up also decoding entities, since those would/will also be escaped when displayed otherwise.

I reviewed the code in the MR and tested the fix here: https://fjgarlin-drupal.dev.devdrupal.org/security

The screenshots above from the before and after are from that URL, where I tested removing the items and then updating them again so they'd be resaved in the database.

The feeds we tested were https://drupal.community/@drupalsecurity.rss and https://drupal.community/@dropismoving.rss, where no "title" element is present in the items.

Marking RTBC.

Thanks for working on this!

Yes, this seems like a bug (because the resulting text is malformed). The fix looks good, but we are combining it with increasing the title length from 40 to 255 characters. I think we should add at least a short change record for people using this feature (e.g. feeds without titles), so they will not be surprised with longer text. Thanks!

I have tested this manually (comparing the old and new code for parsing the description) and it seems good. For example this text:

<p>Search Autocomplete - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-026 3371114 at <a href="https://www.drupal.org" target="_blank" rel="nofollow noopener noreferrer"><span class="invisible">https://www.</span><span class="">drupal.org</span><span class="invisible"></span></a></p>

will change from this: <p>Search Autocomplete - to this: Search Autocomplete - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-026 3371114 at https://www.drupal.org when using the patch.

I have drafted a change record: https://www.drupal.org/node/3383554 → . Feel free to update if needed.

Added a test for this.

Assuming the tests all pass, I'm happy for this to be committed.

Thanks for adding the test @mcdruid! It is green, so I think we are good to go here.

Committed, thanks all!

poker10 → closed merge request !4339

Automatically closed - issue fixed for 2 weeks with no activity.