From 49a2429a4ca44a26132bb714166dbdb4748bf083 Mon Sep 17 00:00:00 2001
From: Colin Powell <colin@unbl.ink>
Date: Sun, 12 Apr 2026 12:48:22 -0400
Subject: [PATCH] [templates} Fix escaping HTML bugs in notes]

---
 vrobbler/apps/scrobbles/dataclasses.py         | 18 ++++++++++--------
 vrobbler/templates/foods/food_detail.html      |  2 +-
 .../templates/lifeevents/lifeevent_detail.html |  2 +-
 .../locations/geolocation_detail.html          |  2 +-
 vrobbler/templates/tasks/task_detail.html      |  2 +-
 .../templates/webpages/webpage_detail.html     |  2 +-
 6 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/vrobbler/apps/scrobbles/dataclasses.py b/vrobbler/apps/scrobbles/dataclasses.py
index 9bc8a1e..f9f582a 100644
--- a/vrobbler/apps/scrobbles/dataclasses.py
+++ b/vrobbler/apps/scrobbles/dataclasses.py
@@ -51,26 +51,28 @@ class BaseLogData(JSONDataclass):
         return {}
 
     def notes_as_str(self, separator: str = " | ") -> str:
+        import html
         import re
 
         if not self.notes:
             return ""
 
         if isinstance(self.notes, str):
-            note_str = self.notes.encode("utf-8").decode("unicode_escape")
-            return re.sub(r"\s*\[start:\d+\|end:\d+\]$", "", note_str)
+            return html.escape(re.sub(r"\s*\[start:\d+\|end:\d+\]$", "", self.notes))
 
         if isinstance(self.notes, list):
             cleaned_notes = []
             for note in self.notes:
-                cleaned = note.encode("utf-8").decode("unicode_escape")
-                cleaned = re.sub(r"\s*\[start:\d+\|end:\d+\]$", "", cleaned)
+                cleaned = html.escape(re.sub(r"\s*\[start:\d+\|end:\d+\]$", "", note))
                 cleaned_notes.append(cleaned)
             return separator.join(cleaned_notes)
 
         return ""
 
     def notes_as_html(self) -> str:
+        import html
+        from django.utils.safestring import mark_safe
+
         if not self.notes:
             return ""
 
@@ -82,11 +84,11 @@ class BaseLogData(JSONDataclass):
 
         html_notes = []
         for note in notes_list:
-            escaped_note = note.encode("utf-8").decode("unicode_escape")
-            for line in escaped_note.split("\n"):
+            for line in note.split("\n"):
                 if line.strip():
-                    html_notes.append(f'<div class="sticky-note">{line}</div>')
-        return "".join(html_notes)
+                    escaped_line = html.escape(line)
+                    html_notes.append(f'<div class="sticky-note">{escaped_line}</div>')
+        return mark_safe("".join(html_notes))
 
 
 @dataclass
diff --git a/vrobbler/templates/foods/food_detail.html b/vrobbler/templates/foods/food_detail.html
index 91c0684..960a82e 100644
--- a/vrobbler/templates/foods/food_detail.html
+++ b/vrobbler/templates/foods/food_detail.html
@@ -35,7 +35,7 @@
                 <tr>
                         <td><a href={{scrobble.get_absolute_url}}>{{scrobble.local_timestamp}}</a></td>
                         <td>{% if scrobble.logdata.calories %}{{scrobble.logdata.calories}}{% else %}{{scrobble.media_obj.calories}}{% endif %}</td>
-                        <td>{{scrobble.logdata.notes_as_str|safe}}</td>
+                        <td>{{scrobble.logdata.notes_as_str}}</td>
                 </tr>
                 {% endfor %}
             </tbody>
diff --git a/vrobbler/templates/lifeevents/lifeevent_detail.html b/vrobbler/templates/lifeevents/lifeevent_detail.html
index 0c0baa5..40ef90b 100644
--- a/vrobbler/templates/lifeevents/lifeevent_detail.html
+++ b/vrobbler/templates/lifeevents/lifeevent_detail.html
@@ -37,7 +37,7 @@
                     <tr>
                         <td><a href="{{scrobble.get_absolute_url}}">{{scrobble.local_timestamp}}</a></td>
                         <td><a href="{{scrobble.get_media_source_url}}">{{scrobble.logdata.title}}</a></td>
-                        <td>{{scrobble.logdata.notes_as_str|safe}}</td>
+                        <td>{{scrobble.logdata.notes_as_str}}</td>
                         <td>{{scrobble.source}}</td>
                     </tr>
                     {% endfor %}
diff --git a/vrobbler/templates/locations/geolocation_detail.html b/vrobbler/templates/locations/geolocation_detail.html
index 6d0a167..e5dc8e8 100644
--- a/vrobbler/templates/locations/geolocation_detail.html
+++ b/vrobbler/templates/locations/geolocation_detail.html
@@ -66,7 +66,7 @@
                     <tr>
                         <td><a href={{scrobble.get_absolute_url}}>{{scrobble.local_timestamp}}</a></td>
                         <td>{% for person in scrobble.logdata.with_people%}{{person}}{% if not forloop.last %}, {% endif%}{% endfor %}</td>
-                        <td>{{scrobble.logdata.notes_as_str|safe}}</td>
+                        <td>{{scrobble.logdata.notes_as_str}}</td>
                     </tr>
                     {% endfor %}
                 </tbody>
diff --git a/vrobbler/templates/tasks/task_detail.html b/vrobbler/templates/tasks/task_detail.html
index fdc3333..e5798fd 100644
--- a/vrobbler/templates/tasks/task_detail.html
+++ b/vrobbler/templates/tasks/task_detail.html
@@ -64,7 +64,7 @@
                     <tr>
                         <td><a href="{{scrobble.get_absolute_url}}">{{scrobble.local_timestamp}}</a></td>
                         <td><a href="{{scrobble.get_media_source_url}}">{{scrobble.logdata.title}}</a></td>
-                        <td>{{scrobble.logdata.notes_as_str|safe}}</td>
+                        <td>{{scrobble.logdata.notes_as_str}}</td>
                         <td>{{scrobble.source}}</td>
                     </tr>
                     {% endfor %}
diff --git a/vrobbler/templates/webpages/webpage_detail.html b/vrobbler/templates/webpages/webpage_detail.html
index 0a289ba..6307d67 100644
--- a/vrobbler/templates/webpages/webpage_detail.html
+++ b/vrobbler/templates/webpages/webpage_detail.html
@@ -190,7 +190,7 @@
                 {% for scrobble in scrobbles.all %}
                 <tr>
                     <td><a href={{scrobble.get_absolute_url}}>{{scrobble.local_timestamp}}</a></td>
-                    <td>{% if scrobble.logdata.notes %}{{ scrobble.logdata.notes_as_str|safe }}{% endif %}
+                    <td>{% if scrobble.logdata.notes %}{{ scrobble.logdata.notes_as_str }}{% endif %}
                 </tr>
                 {% endfor %}
             </tbody>