From 3205597c27554f04a0f84e53dad6838e47c315c8 Mon Sep 17 00:00:00 2001
From: Kieran Eglin <kieran.eglin@gmail.com>
Date: Tue, 26 Mar 2024 15:56:42 -0700
Subject: [PATCH] Rendered certain fields HTML-safe; Added logging to confirm
 range request support

---
 lib/pinchflat/podcasts/rss_feed_builder.ex    | 26 ++++++++++++-------
 .../media_items/media_item_controller.ex      |  6 +++++
 .../podcasts/rss_feed_builder_test.exs        |  7 +++++
 3 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/lib/pinchflat/podcasts/rss_feed_builder.ex b/lib/pinchflat/podcasts/rss_feed_builder.ex
index 7e74010..6acef60 100644
--- a/lib/pinchflat/podcasts/rss_feed_builder.ex
+++ b/lib/pinchflat/podcasts/rss_feed_builder.ex
@@ -42,9 +42,9 @@ defmodule Pinchflat.Podcasts.RssFeedBuilder do
       xmlns:podcast="https://podcastindex.org/namespace/1.0"
       xmlns:atom="http://www.w3.org/2005/Atom">
       <channel>
-        <title>#{source.custom_name}</title>
+        <title>#{safe(source.custom_name)}</title>
         <link>#{source.original_url}</link>
-        <description>#{source.description}</description>
+        <description>#{safe(source.description)}</description>
         <category>TV &amp; Film</category>
         <generator>Generated by Pinchflat</generator>
         <language>en-us</language>
@@ -55,11 +55,11 @@ defmodule Pinchflat.Podcasts.RssFeedBuilder do
         <podcast:guid>#{source.uuid}</podcast:guid>
         <image>
           <url>#{feed_image_path}</url>
-          <title>#{source.custom_name}</title>
+          <title>#{safe(source.custom_name)}</title>
           <link>#{source.original_url}</link>
         </image>
-        <itunes:author>#{source.custom_name}</itunes:author>
-        <itunes:subtitle>#{source.custom_name}</itunes:subtitle>
+        <itunes:author>#{safe(source.custom_name)}</itunes:author>
+        <itunes:subtitle>#{safe(source.custom_name)}</itunes:subtitle>
         <itunes:block>yes</itunes:block>
         <itunes:image href="#{feed_image_path}"></itunes:image>
         <itunes:explicit>false</itunes:explicit>
@@ -76,23 +76,31 @@ defmodule Pinchflat.Podcasts.RssFeedBuilder do
     """
     <item>
       <guid isPermaLink="false">#{media_item.uuid}</guid>
-      <title>#{media_item.title}</title>
+      <title>#{safe(media_item.title)}</title>
       <link>#{media_item.original_url}</link>
-      <description>#{media_item.description}</description>
+      <description>#{safe(media_item.description)}</description>
       <pubDate>#{generate_upload_date(media_item)}</pubDate>
       <enclosure
         url="#{media_stream_path(url_base, media_item)}"
         length="#{media_item.media_size_bytes}"
         type="#{MIME.from_path(media_item.media_filepath)}"
       />
-      <itunes:author>#{source.custom_name}</itunes:author>
-      <itunes:subtitle>#{media_item.title}</itunes:subtitle>
+      <itunes:author>#{safe(source.custom_name)}</itunes:author>
+      <itunes:subtitle>#{safe(media_item.title)}</itunes:subtitle>
       <itunes:summary><![CDATA[#{media_item.description}]]></itunes:summary>
       <itunes:explicit>false</itunes:explicit>
     </item>
     """
   end
 
+  defp safe(nil), do: ""
+
+  defp safe(value) do
+    value
+    |> Phoenix.HTML.html_escape()
+    |> Phoenix.HTML.safe_to_string()
+  end
+
   defp generate_self_link(url_base, source) do
     Path.join(url_base, "#{podcast_route(:rss_feed, source.uuid)}.xml")
   end
diff --git a/lib/pinchflat_web/controllers/media_items/media_item_controller.ex b/lib/pinchflat_web/controllers/media_items/media_item_controller.ex
index 5efc308..a741e26 100644
--- a/lib/pinchflat_web/controllers/media_items/media_item_controller.ex
+++ b/lib/pinchflat_web/controllers/media_items/media_item_controller.ex
@@ -1,6 +1,8 @@
 defmodule PinchflatWeb.MediaItems.MediaItemController do
   use PinchflatWeb, :controller
 
+  require Logger
+
   alias Pinchflat.Repo
   alias Pinchflat.Media
   alias Pinchflat.Media.MediaItem
@@ -47,6 +49,8 @@ defmodule PinchflatWeb.MediaItems.MediaItemController do
         {:ok, {start_pos, end_pos}} ->
           length = end_pos - start_pos + 1
 
+          Logger.debug("Streaming media item: #{media_item.uuid} from #{start_pos} to #{end_pos} (#{length} bytes)")
+
           conn
           |> put_resp_content_type(mime_type)
           |> put_resp_header("accept-ranges", "bytes")
@@ -55,6 +59,8 @@ defmodule PinchflatWeb.MediaItems.MediaItemController do
           |> send_file(206, media_item.media_filepath, start_pos, length)
 
         {:error, :invalid_range} ->
+          Logger.debug("Invalid range request for media item: #{media_item.uuid} - serving full file")
+
           conn
           |> put_resp_content_type(mime_type)
           |> put_resp_header("content-length", to_string(file_size))
diff --git a/test/pinchflat/podcasts/rss_feed_builder_test.exs b/test/pinchflat/podcasts/rss_feed_builder_test.exs
index 8146b55..99bf32c 100644
--- a/test/pinchflat/podcasts/rss_feed_builder_test.exs
+++ b/test/pinchflat/podcasts/rss_feed_builder_test.exs
@@ -21,6 +21,13 @@ defmodule Pinchflat.Podcasts.RssFeedBuilderTest do
       assert String.contains?(res, ~s(<?xml version="1.0" encoding="UTF-8"?>))
     end
 
+    test "escapes illegal characters" do
+      source = source_fixture(%{custom_name: "A & B"})
+      res = RssFeedBuilder.build(source)
+
+      assert String.contains?(res, ~s(<title>A &amp; B</title>))
+    end
+
     test "can optionally apply a limit to media items", %{source: source} do
       good_media = media_item_with_attachments(%{source_id: source.id})