fix(chat): do not handle chat usernames as html escaped. Closes #3743

utils/strings.go

@@ -4,6 +4,7 @@ import (
 	"strings"
 
 	"github.com/microcosm-cc/bluemonday"
+	"golang.org/x/net/html"
 )
 
 // StripHTML will strip HTML tags from a string.
@@ -17,6 +18,7 @@ func StripHTML(s string) string {
 func MakeSafeStringOfLength(s string, length int) string {
 	newString := s
 	newString = StripHTML(newString)
+	newString = htmlUnescape(newString)
 
 	// Convert utf-8 string into Unicode code points.
 	codePoints := []rune(newString)
@@ -31,3 +33,19 @@ func MakeSafeStringOfLength(s string, length int) string {
 
 	return newString
 }
+
+func htmlUnescape(input string) string {
+	token := html.NewTokenizer(strings.NewReader(input))
+	var output strings.Builder
+
+	for {
+		tt := token.Next()
+		switch tt {
+		case html.ErrorToken:
+			return output.String()
+		case html.TextToken:
+			text := string(token.Text())
+			output.WriteString(text)
+		}
+	}
+}