Escape feed names in story list

app/commands/feed/import_from_opml.rb

@@ -28,8 +28,8 @@ def find_or_create_group(group_name, user)
     end
 
     def create_feed(parsed_feed, group, user)
-      feed = user.feeds.where(**parsed_feed.slice(:name, :url))
-                 .first_or_initialize
+      name = parsed_feed[:name] && ContentSanitizer.call(parsed_feed[:name])
+      feed = user.feeds.where(name:, url: parsed_feed[:url]).first_or_initialize
       find_feed_name(feed, parsed_feed)
       feed.last_fetched = 1.day.ago if feed.new_record?
       feed.group_id = group.id if group

app/views/stories/_templates.html.erb

@@ -5,7 +5,7 @@
         <i class="fa {{ if(is_starred) { }}fa-star{{ } else { }}fa-star-o{{ } }}" data-star-toggle-target="icon"></i>
       </div>
       <p class="blog-title">
-        {{= source }}
+        {{- source }}
       </p>
     </div>
     <div class="col-md-9">

spec/commands/feed/import_from_opml_spec.rb

@@ -61,6 +61,21 @@ def find_feed(feed_details)
     end
   end
 
+  def evil_opml
+    <<~XML
+      <opml><body>
+        <outline type="rss" xmlUrl="http://example.com/feed.xml"
+          text="&lt;img src=x onerror=&quot;alert(1)&quot;&gt; Evil" />
+      </body></opml>
+    XML
+  end
+
+  it "sanitizes feed names" do
+    described_class.call(evil_opml, user: default_user)
+
+    expect(Feed.last.name).to eq('<img src="x"> Evil')
+  end
+
   context "adding group_id for existing feeds" do
     it "retains exising feeds" do
       feed1 = create_feed(tmw_football)

spec/javascript/setup.ts

@@ -36,7 +36,7 @@ const templateHTML = [
   '        <i class="fa {{ if(is_starred) { }}fa-star{{ } else { }}fa-star-o{{ } }}" data-star-toggle-target="icon"></i>',
   "      </div>",
   '      <p class="blog-title">',
-  "        {{= source }}",
+  "        {{- source }}",
   "      </p>",
   "    </div>",
   '    <div class="col-md-9">',

spec/javascript/spec/views/story_view_spec.ts

@@ -49,6 +49,16 @@ describe("StoryView", function () {
       assertPropertyRendered(view.el, story, "source");
     });
 
+    it("should escape blog title", function () {
+      const evilStory = new Story({ ...story.attributes, source: "<img src=x>" });
+      const evilView = new StoryView({ model: evilStory });
+      evilView.render();
+
+      const blogTitle = evilView.el.querySelector(".blog-title");
+      expect(blogTitle.querySelector("img")).toBeNull();
+      expect(blogTitle.textContent.trim()).toBe("<img src=x>");
+    });
+
     it("should render story headline", function () {
       assertTagExists(view.el, ".story-title");
       assertPropertyRendered(view.el, story, "headline");