bluesky.to_as1: escape HTML characters in app.bsky.actor.profile description

for snarfed/bridgy-fed#1144

also includes a `@skip`ed test for doing the same thing in `app.bsky.feed.post` `text`, which is more difficult to implement because we'll have to shuffle facet/tag indices over to match every time we escape an HTML char.

Author: snarfed

README.md

@@ -315,6 +315,7 @@ _Non-breaking changes:_
     * Add hashtag facet support.
     * Convert blobs in embeds to `getBlob` image URLs.
     * `app.bsky.actor.profile`: add HTML links for URLs in `summary` ([snarfed/bridgy-fed#1065](https://github.com/snarfed/bridgy-fed/issues/1065)).
+    * Escape HTML characters (`<`, `>`, `&`) in `app.bsky.actor.profile` `description` field.
     * Bug fix for `create`/`update` activities with bare string `object`.
   * `from_as1`:
     * Add hashtag, mention, block, and flag support. Interpret `tags` with missing `objectType` as hashtags.

granary/bluesky.py

@@ -6,6 +6,7 @@
 """
 import copy
 from datetime import datetime, timezone
+import html
 import json
 import logging
 from pathlib import Path
@@ -1053,11 +1054,12 @@ def to_as1(obj, type=None, uri=None, repo_did=None, repo_handle=None,
         'username': obj.get('handle') or repo_handle,
       }
 
+    desc = html.escape(obj.get('description') or '')
     ret.update({
       'url': util.dedupe_urls(urls),
       'displayName': obj.get('displayName'),
       # TODO: for app.bsky.feed.generator, use descriptionFacets
-      'summary': util.linkify(obj.get('description') or '', pretty=True),
+      'summary': util.linkify(desc, pretty=True),
       'image': images,
       'published': obj.get('createdAt'),
     })
@@ -1085,7 +1087,10 @@ def to_as1(obj, type=None, uri=None, repo_did=None, repo_handle=None,
         }]
 
   elif type == 'app.bsky.feed.post':
+    # TODO: escape HTML chars. difficult because we have to shuffle over facet
+    # indices to match.
     text = obj.get('text', '')
+    text_encoded = text.encode()
 
     # convert facets to tags
     tags = []
@@ -1117,7 +1122,6 @@ def to_as1(obj, type=None, uri=None, repo_did=None, repo_handle=None,
 
       try:
         if byte_start is not None:
-          text_encoded = text.encode()
           tag['startIndex'] = len(text_encoded[:byte_start].decode())
           if byte_end is not None:
             name = text_encoded[byte_start:byte_end].decode()

granary/tests/test_bluesky.py

@@ -4,6 +4,7 @@
 """
 import copy
 from io import BytesIO
+from unittest import skip
 from unittest.mock import ANY, patch
 
 from oauth_dropins.webutil import testutil, util
@@ -1743,6 +1744,15 @@ def test_to_as1_profile_links_in_bio(self):
       'description': 'one http://li.nk/foo two li.nk three https://www.li.nk/',
     }))
 
+  def test_to_as1_profile_escape_html_chars(self):
+    self.assert_equals({
+      'objectType': 'person',
+      'summary': 'one <two> <thr&ee>',
+    }, to_as1({
+      '$type': 'app.bsky.actor.profile',
+      'description': 'one <two> <thr&ee>',
+    }))
+
   def test_to_as1_profile_bsky_social_handle_is_not_url(self):
     self.assert_equals({
       'objectType': 'person',
@@ -1821,6 +1831,16 @@ def test_to_as1_post_uri(self):
       'published': '2007-07-07T03:04:05.000Z',
     }, to_as1(POST_BSKY, uri='at://alice.com/app.bsky.feed.post/123'))
 
+  @skip
+  def test_to_as1_post_escape_html_chars(self):
+    self.assert_equals({
+      'objectType': 'note',
+      'summary': 'one &lt;two&gt; &lt;thr&amp;ee&gt;',
+    }, to_as1({
+      '$type': 'app.bsky.feed.post',
+      'text': 'one <two> <thr&ee>',
+    }))
+
   def test_to_as1_post_view(self):
     self.assert_equals(POST_AS['object'], to_as1(POST_VIEW_BSKY))