Broken HTML code in forums

Bug report specifically about broken forum HTML code.

From search there have been a number of these threads lately, but affecting not only forums but also rest-My Opera (blogs and whatever else there is out there). Rest-My Opera seems to be OK, but these forums are not. This forum thread could be useful to set up minimal code samples and expected results. Given that this is a forum thread it should be easy enough to spot regressions if they were to appear later on.

Let's start with an easy regression:

<a href="http://my.opera.com/community/forums/topic.dml?id=1132152">This thread</a>

Test case: <a href="http://my.opera.com/community/forums/topic.dml?id=1132152">This thread</a>
Expected: This should be a link to this very thread with link text "This thread"; no HTML code should be displayed.

Simpler case: "http://my.opera.com/"

The forum used to ignore URLs inside quotes, now it doesn't. Since it is converting your text into a link, the rest of your code breaks.

That depends a bit on the sequence the text is processed and parsed. For me it would be natural to turn BBCode into HTML and then parse the text nodes to generate smileys and links and the like (but it would be desirable that quoted links didn't link), but I believe that HTML has been turned into BBCode in this forum traditonally.

Now no HTML code seems to working, so the order is a bit moot. Example with lists:

<ul><li>Unordered list item 1<li>Unordered list item 2</ul>

Test case 2: <ul><li>Unordered list item 1<li>Unordered list item 2</ul>

Expected result:
* Unordered list item 1
* Unordered list item 2

Strangely ... there was some HTML that I quoted recently (in a code tag within the quote tag) where it was treated as regular HTML rather than code ...

Originally posted by jax:

Let's start with an easy regression:

This thread

Test case: This thread
Expected: This should be a link to this very thread with link text "This thread"; no HTML code should be displayed.

Apparently the code tag doesn't even matter ...

Originally posted by jax:

Unordered list item 1
Unordered list item 2

Test case 2:

• Unordered list item 1
• Unordered list item 2

Expected result:
* Unordered list item 1
* Unordered list item 2

Yes, HTML code in quotes seems to work as intended. Not exactly a bug fix or workaround though, especially as the BBC 'code' element lost its magic (it rendered the code instead of displaying it).

Anyone at Opera who can tell when this will be fixed? It breaks existing posts, sometimes badly.

My Opera is getting a new URL detection system, among other related things (they decided not to allow HTML and BBCode on some "About" parts).

These undergoing changes must be the reason it's broken. I reported on the thread (linked above) about the HTML formatting lost in the forums but it get locked and my posts deleted / edited (let's hope it doesn't happen again since I'm completely in-topic).

I'd like to have HTML formatting and linking, etc, in forums back, since posts, links, images, signatures and even posts by Opera employees are broken now.
Talking about Opera employees and the removal of HTML/BBCode from the About page, you can see a lot of them used the formatting in their about page fields and now there's a lot of broken code (and from other members as well). I already gave my opinion on how this move makes no sense since spammers can still create a new blog post with the linked things and have it as the default page when people visit their page.

So, in order to fix the things I wish you could bring back the formatting to these fields please. And to the forums.

Well, I set up this thread specifically for HTML issues in the forum (and there probably should be another for BB code issues, and issues for mixed BB code and HTML as well, like the unexpected behaviour of HTML+BBCode quote above), with test cases. If Opera were to e.g. add SVG support later, not likely any time soon but not unreasonable, I think that or any other non-HTML (and non-BBC) markup would be on-topic here as a natural extension of HTML. Other forum issues, like e.g. CSS/presentation, or any non-forum bugs, HTML or otherwise, should be off-topic.

That said I would have to say that I agree with you, in my opinion that thread shouldn't have been closed, and probably ought to be reopened. It was a lively constructive thread that provided useful information to the developers about unintended side-effects of what to some of the users was a very annoying regression. I didn't read your last post, but the people affected were mostly constructive as well. I suggest you talk to the Opera people in that thread and ask if they can reopen it. This too, is off-topic on this thread, and incidentally skirting the Opera forum rules (Brad Pitt voiceover: "7th Rule of Conduct: You DO NOT talk about the Rules of Conduct"...).

Originally posted by jax:

ought to be reopened

That's ok, now I said everything again here, politely.

I hope they can rethink about the changes (on how it affects the community and forums). Users searching / browsing older topics and looking profiles will see a lot broken things, references, helpful links. And also the fact that most group's rules are formatted on their about pages. After thinking more of that, decide what will be done.

The HTML parser is still broken.

Oh, thanks for opening the thread. Instead of using

[url=http://my.opera.com/chooseopera]Opera News[/url]

I started using

<a href="http://my.opera.com/chooseopera">Opera News</a>

but it didn't work so I thought the forums did not support it.

Up until a month or so ago they did. As above post show they still do when quoted. Hopefully they will do so again within a month.

NIce day today. Please help me... I have a question about Blog design (CSS Code) but I can hardly find where do it... Please guide me to the right forum. May anyone of you...

Thanks

The HTML parser is still broken.

We'll look into it.

Err, HTML not working in forum posts is intentional AFAIK, use BBCode?

You want lists:

[list]
[*] unordered list 1
[*] unordered list 2
[/list]

• unordered list 1
• unordered list 2

you want links:

[url=http://my.opera.com]link to myopera[/url]

link to myopera

any other issues?

Yes, the previously posted posts are broken...
Isn't that possible to blacklist only the tags that could potentially be a treat?

Kind of related: what about allowing BBCode back again in some about pages sections like "Why I choose the Opera browser"? I wish I could put the link to my article(s) there for example...

Originally posted by nicomen:

Err, HTML not working in forum posts is intentional AFAIK, use BBCode?

If you remove HTML support from the forums, which they have had since the beginning, that regression should be handled properly.

It is obviously not my decision to take, but in my view it would be the wrong one. First, Opera is a web company, it eats web standards for breakfast, lunch, and midnight pizza. HTML is a web standard, BBCode is not. Why this matters? As we move into HTML5, CSS3, SVG, and a swathe of other 2-5 letter acronyms Opera might want to highlight, or better yet take advantage of, those capabilities, in blogs, in forums, in other content. Guess what? BBCode is stuck in a HTML2 world. Of course you could extend BBCode, but that is fraught with danger and worse yet work. And when you add a bog-standard BBCode module you got a compatibility problem. BBCode is a blind alley, while HTML5 is a significant step towards collaborative content.

My recommendation would be to slowly depreciate BBCode for whitelisted web. Any markup, including HTML, needs to be whitelisted because the web hasn't yet adressed that the creator of this comment is me, who should be untrusted to most, and not my.opera.com who may or may not be trusted. However whitelisting is a fairly known entity, with gotchas, but with gotchas I am sure you can handle.

Anyway, if you make such major design changes, like deprecating HTML or BBCode in the forums or elsewhere, you should handle it properly and not leave dead and broken content in your wake based on a whim. The users made that content, you broke it. If you really can't give us the capabilities back, like those about fields mentioned by rafaelluik, you should apologize and explain. Better yet you should ask before you remove, you might find that it is more important than you think, or that nobody cares and you can do what you like.

In the case of the HTML/BBCode the capabilities are comparable (BBCode is a small subset of course, but functionally equivalent to the whitelisted HTML). If you deprecate HTML, existing HTML code in posts should be reformatted using BBCode equivalents. Likewise if you deprecate BBCode. If you keep both parallel and equivalent you need to do neither. But right now the forums are full of broken posts, and you broke them. That better be because of a change in policy and not because of an AFAIK. And if you broke them you should repair them.

This isn't exactly this way...
The BBCode is transformed by My Opera (and other sites) servers in some way and very standards-friendly, I noted this in a topic.

Well, if that was really the only/best way to avoid a security issue then it's fine...

jax:

The forums had an unknown subset of html available, until we enforced bbcode only. Since they are just a forum, and not something that needs advanced ways of layout out or structuring text, bbcode suffices.

It also helps removing an attack vector, and it also helps keeping posts comprehensible for most people (not including millions of objects or images or what not.

The real bug in this case is that HTML is allowed inside [ quote ] tags IMHO.

I use html in my blog since bbcode breaks RSS. Also, IMO html is easier than bbcode. Or the very least you could turn html off for newbies and give up trusted old forum members html ability. The no html policy has broken many signatures and old posts.

Originally posted by nicomen:

jax:

The forums had an unknown subset of html available, until we enforced bbcode only. Since they are just a forum, and not something that needs advanced ways of layout out or structuring text, bbcode suffices.

It also helps removing an attack vector, and it also helps keeping posts comprehensible for most people (not including millions of objects or images or what not.

Sure you need a specific subset of HTML/markup, centrally maintained, just like you now have a specific set of BBCode (presumably) centrally maintained.

I can, and quite possibly will, detail the shortcomings of BBCode. It is really not a good solution. But sure, it has basic formatting, I can say "BBCode sucks " in a number of ways. When you want to something more, like code, it is a different story. As long as this decision is reversible we can live with it.


My point for now is that you have made a mess several metric tons of existing forum content by this. You should unbreak it.

Originally posted by nicomen:

The real bug in this case is that HTML is allowed inside [ quote ] tags IMHO.

Been using quote tags with HTML markup in <http://my.opera.com/operawiki/forums/> a lot. I use that to work around a few things. One is I sometimes need nested lists and that doesn't work right with bbcode. The other is that list items on all the forums don't have any padding so they look like crap. I use <p> inside <li> to work around that.

<http://my.opera.com/operawiki/forums/topic.dml?id=1142752> is a perfect example. I can't get the necessary padding/margin between list items and can't get the necessary nested lists without using a quote tag and real HTML markup. Even though the quote tag italicizes, the text, it's still worth it.

Instead of bbcode, I'd rather have markdown like stackoverflow.com has. It's both secure and allows you to do more than bbcode.

Originally posted by burnout426:

I'd rather have markdown like stackoverflow.com has

Their implementation is at <http://code.google.com/p/markdownsharp/>. And, <http://stackoverflow.com/editing-help#code> is what that implementation supports.

I had a look around the forums. It's a total mess, but it seems that a 90% solution would be to let the parser allow the start tags

<i>
<b>
<a\w+href=\"[^"]+\">

and corresponding end tag.

Speaking of end tags, BBCode allows

[s]

to mark strikeout. It cannot be changed now for similar reasons, but it makes for "false positives" as this is very common in code and speech:

index[s]
Here you report your favourite bug[s]

That incidentally is also a (lesser) problem with italics.

index[i]

triggers italic. The workaround would be not to bbcode s and i unless there is a corresponding end tag.