Escape feed names in story list

**What** - Render the feed name in the story template with the escaped `{{- }}` form instead of raw `{{= }}`. - Run feed names from OPML imports through `ContentSanitizer`, as `Feed::Create` already does. **Why** Feed names from OPML imports were saved as-is and then inserted into the story list as raw HTML, so markup in a feed name could run in the reader's browser. **Notes** Names already cleaned by the sanitizer have `&` stored as `&`, which now shows as `&` in the story list, matching the feeds page.
mockdeep · Oct 22, 2026 · Oct 22, 2026 · Oct 22, 2026 · a47ac7d5ef074c15fa31a437764a8abd981cf5ac
commit a47ac7d5ef074c15fa31a437764a8abd981cf5ac
diff --git a/app/commands/feed/import_from_opml.rb b/app/commands/feed/import_from_opml.rb
@@ -28,8 +28,8 @@ def find_or_create_group(group_name, user)
     end
 
     def create_feed(parsed_feed, group, user)
-      feed = user.feeds.where(**parsed_feed.slice(:name, :url))
-                 .first_or_initialize
+      name = parsed_feed[:name] && ContentSanitizer.call(parsed_feed[:name])
+      feed = user.feeds.where(name:, url: parsed_feed[:url]).first_or_initialize
       find_feed_name(feed, parsed_feed)
       feed.last_fetched = 1.day.ago if feed.new_record?
       feed.group_id = group.id if group

diff --git a/app/views/stories/_templates.html.erb b/app/views/stories/_templates.html.erb
@@ -5,7 +5,7 @@
         <i class="fa {{ if(is_starred) { }}fa-star{{ } else { }}fa-star-o{{ } }}" data-star-toggle-target="icon"></i>
       </div>
       <p class="blog-title">
-        {{= source }}
+        {{- source }}
       </p>
     </div>
     <div class="col-md-9">

diff --git a/spec/commands/feed/import_from_opml_spec.rb b/spec/commands/feed/import_from_opml_spec.rb
@@ -61,6 +61,21 @@ def find_feed(feed_details)
     end
   end
 
+  def evil_opml
+    <<~XML
+      <opml><body>
+        <outline type="rss" xmlUrl="http://example.com/feed.xml"
+          text="&lt;img src=x onerror=&quot;alert(1)&quot;&gt; Evil" />
+      </body></opml>
+    XML
+  end
+
+  it "sanitizes feed names" do
+    described_class.call(evil_opml, user: default_user)
+
+    expect(Feed.last.name).to eq('<img src="x"> Evil')
+  end
+
   context "adding group_id for existing feeds" do
     it "retains exising feeds" do
       feed1 = create_feed(tmw_football)

diff --git a/spec/javascript/setup.ts b/spec/javascript/setup.ts
@@ -36,7 +36,7 @@ const templateHTML = [
   '        <i class="fa {{ if(is_starred) { }}fa-star{{ } else { }}fa-star-o{{ } }}" data-star-toggle-target="icon"></i>',
   "      </div>",
   '      <p class="blog-title">',
-  "        {{= source }}",
+  "        {{- source }}",
   "      </p>",
   "    </div>",
   '    <div class="col-md-9">',

diff --git a/spec/javascript/spec/views/story_view_spec.ts b/spec/javascript/spec/views/story_view_spec.ts
@@ -49,6 +49,16 @@ describe("StoryView", function () {
       assertPropertyRendered(view.el, story, "source");
     });
 
+    it("should escape blog title", function () {
+      const evilStory = new Story({ ...story.attributes, source: "<img src=x>" });
+      const evilView = new StoryView({ model: evilStory });
+      evilView.render();
+
+      const blogTitle = evilView.el.querySelector(".blog-title");
+      expect(blogTitle.querySelector("img")).toBeNull();
+      expect(blogTitle.textContent.trim()).toBe("<img src=x>");
+    });
+
     it("should render story headline", function () {
       assertTagExists(view.el, ".story-title");
       assertPropertyRendered(view.el, story, "headline");