From 527fba51c26ea033740f90369b25c3c485cc9ff9 Mon Sep 17 00:00:00 2001
From: mubbsharanwar <mubbshar.anwar@arbisoft.com>
Date: Thu, 28 Aug 2025 13:30:26 +0500
Subject: [PATCH] fix: fix script tag quot escaped

Truncator escapes quot to encoding to prevent XSS.
---
 .../discussion/rest_api/discussions_notifications.py |  5 ++++-
 .../rest_api/tests/test_discussions_notifications.py | 12 +++++-------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/lms/djangoapps/discussion/rest_api/discussions_notifications.py b/lms/djangoapps/discussion/rest_api/discussions_notifications.py
index 8249f170273d..8efb2e8acb83 100644
--- a/lms/djangoapps/discussion/rest_api/discussions_notifications.py
+++ b/lms/djangoapps/discussion/rest_api/discussions_notifications.py
@@ -2,6 +2,7 @@
 Discussion notifications sender util.
 """
 import re
+import html
 
 from bs4 import BeautifulSoup, Tag
 from django.conf import settings
@@ -447,7 +448,9 @@ def clean_thread_html_body(html_body):
     """
     Get post body with tags removed and limited to 500 characters
     """
-    html_body = BeautifulSoup(Truncator(html_body).chars(500, html=True), 'html.parser')
+    truncated_body = Truncator(html_body).chars(500, html=True)
+    truncated_body = html.unescape(truncated_body)
+    html_body = BeautifulSoup(truncated_body, 'html.parser')
 
     tags_to_remove = [
         "a", "link",  # Link Tags
diff --git a/lms/djangoapps/discussion/rest_api/tests/test_discussions_notifications.py b/lms/djangoapps/discussion/rest_api/tests/test_discussions_notifications.py
index 247bd23540cf..aaa920a0ff78 100644
--- a/lms/djangoapps/discussion/rest_api/tests/test_discussions_notifications.py
+++ b/lms/djangoapps/discussion/rest_api/tests/test_discussions_notifications.py
@@ -2,7 +2,6 @@
 Unit tests for the DiscussionNotificationSender class
 """
 import re
-import django
 import unittest
 from unittest.mock import MagicMock, patch
 
@@ -109,13 +108,12 @@ def test_html_tags_removal(self):
         <p>Script test: <script>alert("hello");</script></p>
         <p>Some other content that should remain.</p>
         """
-        excepted_script_quot = 'alert(&amp;quot;hello&amp;quot;);' if django.VERSION >= (5, 0) else 'alert("hello");'
         expected_output = (
-            f'<p style="margin: 0">This is a link to a page.</p>'
-            f'<p style="margin: 0">Here is an image: </p>'
-            f'<p style="margin: 0">Embedded video: </p>'
-            f'<p style="margin: 0">Script test: {excepted_script_quot}</p>'
-            f'<p style="margin: 0">Some other content that should remain.</p>'
+            '<p style="margin: 0">This is a link to a page.</p>'
+            '<p style="margin: 0">Here is an image: </p>'
+            '<p style="margin: 0">Embedded video: </p>'
+            '<p style="margin: 0">Script test: alert("hello");</p>'
+            '<p style="margin: 0">Some other content that should remain.</p>'
         )
 
         result = clean_thread_html_body(html_body)