Skip to content

Conversation

@ZogStriP
Copy link
Member

When "display name on posts" is enabled and "prioritize username in UX" is disabled, quoting a user with quotation marks in their display name (e.g., John "The Dev" Smith) breaks the quote markdown:

[quote="John "The Dev" Smith, post:1, topic:2"]

The BBCode parser's regex "([^"]+)" stops at the first " inside the name, capturing only John instead of the full name.

Alternatives considered:

  • Backslash escaping (\"): Would require updating the parser regex to support escape sequences and adding unescape logic. Adds complexity and risks breaking existing quotes.

  • URL encoding (%22): Requires decoding when rendering. Using decodeURIComponent on user input creates XSS risk. A safe decoder that only decodes specific characters adds complexity and attack surface for minimal benefit.

The simplest solution is to strip quotation marks from names when building the quote BBCode. This is safe (no user input decoding), simple (no parser changes), and the minor cosmetic loss in the quote attribution is an acceptable trade-off.

The stripQuotationMarks function is defined alongside the existing QUOTATION_MARKS array in bbcode-block.js to keep related logic together and avoid duplication.

Ref - https://meta.discourse.org/t/391153

When "display name on posts" is enabled and "prioritize username in UX"
is disabled, quoting a user with quotation marks in their display name
(e.g., `John "The Dev" Smith`) breaks the quote markdown:

    [quote="John "The Dev" Smith, post:1, topic:2"]

The BBCode parser's regex `"([^"]+)"` stops at the first `"` inside the
name, capturing only `John ` instead of the full name.

Alternatives considered:

- Backslash escaping (`\"`): Would require updating the parser regex to
  support escape sequences and adding unescape logic. Adds complexity
  and risks breaking existing quotes.

- URL encoding (`%22`): Requires decoding when rendering. Using
  `decodeURIComponent` on user input creates XSS risk. A safe decoder
  that only decodes specific characters adds complexity and attack
  surface for minimal benefit.

The simplest solution is to strip quotation marks from names when
building the quote BBCode. This is safe (no user input decoding),
simple (no parser changes), and the minor cosmetic loss in the quote
attribution is an acceptable trade-off.

The `stripQuotationMarks` function is defined alongside the existing
`QUOTATION_MARKS` array in bbcode-block.js to keep related logic
together and avoid duplication.

Ref - https://meta.discourse.org/t/391153
@discoursebot
Copy link

This pull request has been mentioned on Discourse Meta. There might be relevant details there:

https://meta.discourse.org/t/quotes-in-full-name-mess-up-quote-markdown/391153/4

@discoursebot
Copy link

This pull request has been mentioned on Discourse Meta. There might be relevant details there:

https://meta.discourse.org/t/daily-summary-5am-utc/291851/681

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants