From 83c657afa557ac3cdfd2e3888511b403857de8aa Mon Sep 17 00:00:00 2001
From: Roger Braun <roger@rogerbraun.net>
Date: Wed, 14 Jun 2017 14:46:18 +0200
Subject: [PATCH] Do some basic escaping.

---
 lib/pleroma/web/twitter_api/utils.ex            |  2 +-
 test/web/twitter_api/twitter_api_test.exs       |  2 +-
 test/web/twitter_api/twitter_api_utils_test.exs | 14 ++++++++++++++
 3 files changed, 16 insertions(+), 2 deletions(-)
 create mode 100644 test/web/twitter_api/twitter_api_utils_test.exs

diff --git a/lib/pleroma/web/twitter_api/utils.ex b/lib/pleroma/web/twitter_api/utils.ex
index 65d893869..5cbe0cf9c 100644
--- a/lib/pleroma/web/twitter_api/utils.ex
+++ b/lib/pleroma/web/twitter_api/utils.ex
@@ -11,7 +11,7 @@ def attachments_from_ids(ids) do
   def add_attachments(text, attachments) do
     attachment_text = Enum.map(attachments, fn
       (%{"url" => [%{"href" => href} | _]}) ->
-        "<a href='#{href}' class='attachment'>#{Path.basename(href)}</a>"
+        "<a href=\"#{URI.encode(href)}\" class='attachment'>#{Path.basename(href)}</a>"
       _ -> ""
     end)
     Enum.join([text | attachment_text], "<br>\n")
diff --git a/test/web/twitter_api/twitter_api_test.exs b/test/web/twitter_api/twitter_api_test.exs
index da880e67c..6848413cc 100644
--- a/test/web/twitter_api/twitter_api_test.exs
+++ b/test/web/twitter_api/twitter_api_test.exs
@@ -34,7 +34,7 @@ test "create a status" do
 
     { :ok, activity = %Activity{} } = TwitterAPI.create_status(user, input)
 
-    assert get_in(activity.data, ["object", "content"]) == "Hello again, <a href='shp'>@shp</a>.<br>\nThis is on another line. #2hu #epic #phantasmagoric<br>\n<a href='http://example.org/image.jpg' class='attachment'>image.jpg</a>"
+    assert get_in(activity.data, ["object", "content"]) == "Hello again, <a href='shp'>@shp</a>.<br>\nThis is on another line. #2hu #epic #phantasmagoric<br>\n<a href=\"http://example.org/image.jpg\" class='attachment'>image.jpg</a>"
     assert get_in(activity.data, ["object", "type"]) == "Note"
     assert get_in(activity.data, ["object", "actor"]) == user.ap_id
     assert get_in(activity.data, ["actor"]) == user.ap_id
diff --git a/test/web/twitter_api/twitter_api_utils_test.exs b/test/web/twitter_api/twitter_api_utils_test.exs
new file mode 100644
index 000000000..62aa7843b
--- /dev/null
+++ b/test/web/twitter_api/twitter_api_utils_test.exs
@@ -0,0 +1,14 @@
+defmodule Pleroma.Web.TwitterAPI.UtilsTest do
+  alias Pleroma.Web.TwitterAPI.Utils
+  use Pleroma.DataCase
+
+  test "it adds attachment links to a given text and attachment set" do
+    attachment = %{
+      "url" => [%{"href" => "http://heise.de/i\"m a boy.png"}]
+    }
+
+    res = Utils.add_attachments("", [attachment])
+
+    assert res == "<br>\n<a href=\"http://heise.de/i%22m%20a%20boy.png\" class='attachment'>i\"m a boy.png</a>"
+  end
+end