<!--IssueSummary start--> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Collaborate/take over this issue](https://contributors.gitlab.com/manage-issue?action=work&projectId=278964&issueIid=361722) </details> <!--IssueSummary end--> ### Summary When someone posts a comment containing a line break, the produced Atom feed will be invalid. ### Steps to reproduce 1. Send a comment to containing either <code>foo\\<br>bar</code> or `foo<br>bar` to an issue. 2. Visit project’s Activities Atom feed. ### Example Project Check https://gitlab.com/jtojnar/extensions.atom for example, which is broken by the first comment https://gitlab.com/jtojnar/extensions/-/issues/1. ### What is the current *bug* behavior? The feed will contain a literal `<br>` element, breaking the Atom feed. ### What is the expected *correct* behavior? The feed should contain a valid XML code. ### Output of checks This bug happens on GitLab.com ### Possible fixes See https://validator.w3.org/feed/docs/atom.html#text: - The input needs to be sanitized to be valid XML if we want to use `type=xhtml`, - or switch to `type=html` and - either escape the HTML code, - or wrap it with `CDATA`. ## Implementation plan > [!important] > _This guidance was generated by GitLab Duo and may be inaccurate. Please verify before use._ **Root cause:** The Atom feed uses `type=xhtml` in `app/views/events/_event.atom.builder`, which requires valid XHTML inside the `<summary>` element. The note summary is rendered in `app/views/events/_event_note.atom.haml` via `markdown_field(note, :note)` without passing `pipeline: :atom` to the renderer. As a result, `<br>` tags from hard-wrapped lines or explicit line breaks are emitted as bare `<br>` (not the XHTML-compliant `<br/>`), making the feed invalid. **Two possible fixes:** - **(a) Preferred — simpler:** In `_event_note.atom.haml`, change `markdown_field(note, :note)` to `markdown(note.note, pipeline: :atom, ...)`, matching the pattern already used in `_event_issue.atom.haml` and `_event_merge_request.atom.haml` - **(b) Alternative:** Change the `xml.summary` element type from `xhtml` to `html` in `_event.atom.builder` and ensure all rendered HTML is properly escaped or CDATA-wrapped **Also:** Check `_event_push.atom.haml` for the same issue, and add a test in `spec/helpers/events_helper_spec.rb` for notes containing `<br>` tags.