"Note to Admin" feature might be bugged?

[SabrinaTheDabbler]

Hello all! I have noticed a bizarre and seemingly unfixable bug/issue when writing notes in the editing page of my stories.

When editing a draft of a story, at the very bottom is the "Notes to Admin (optional, not published)" section. I will write normally with normal punctuation marks appropriately used, and it will transform into some very strange formatting.

For example, here is what I have written in one of my notes to the admin:

Please keep the original title: "Night Terrors: The Monster's POV"

I've edited all CAPITALIZED words to be <i>Italicized</i> instead, as well as changed some existing regular words to Italics. I've also changed some words throughout the story, to lessen the repetition of the same words (e.g. The Monster) over and over again.

I've added at the beginning:
"Thank you to u/AnjoCeynwulfe on Reddit for inspiring this story!"


When I return to the draft to edit once again, I found what I have written has transformed into this:

Please keep the original title: &amp;quot;Night Terrors: The Monster&amp;#039;s POV&amp;quot;

I&amp;#039;ve edited all CAPITALIZED words to be &amp;lt;i&amp;gt;Italicized&amp;lt;/i&amp;gt; instead, as well as changed some existing regular words to Italics. I&amp;#039;ve also changed some words throughout the story, to lessen the repetition of the same words (e.g. The Monster) over and over again.

I&amp;#039;ve added at the beginning:
&amp;quot;Thank you to u/AnjoCynewulfe on Reddit for inspiring this story!&amp;quot;


And once I'm in the "Preview&Publish" page:



So, what gives? It doesn't seem to like apostrophes or quotation marks, for some reason?
- Why is it doing this in the first place?
- Why does it not save when I attempt to fix it?

Thank you!

 

[Britva415]

The formatting is a bug, but is it preventing you from submitting the story for publication? That would be an even worse bug.

 

[SabrinaTheDabbler]

The formatting is a bug, but is it preventing you from submitting the story for publication? That would be an even worse bug.

Thank you!

I'm not sure yet, as the example I provided was one of only two stories I've attempted this with, and I've gone back once or twice after the first time to further adjust actual information (Story Text and Tags). So they were both transferred from "Pending" status back into "Draft" status, before I then hit the "Preview&Publish" button again and it seems as though they've returned to "Pending" status.

 

[RejectReality]

It's a cosmetic error. Most punctuation and symbols get transformed into their special character verison before they're added to the database. It's a base level of protecting against attempts to inject malicious code through a form. The only thing "wrong" here is that it wasn't reversed for display in the preview form. Odds are it is on the backend, so all Laurel sees are the expected symbols. And if not, that particular moderator note will likely encourage Laurel to have Manu drop the code snippet in there to do it. LOL

It will have zero impact on the submission process beyond you not being able to review your moderator note without your eyes going crossed.

 

[ElectricBlue]

So, what gives? It doesn't seem to like apostrophes or quotation marks, for some reason?
- Why is it doing this in the first place?
- Why does it not save when I attempt to fix it?

It's been doing it a while, you can't do anything about it, but the message gets through with your submission, so I wouldn't worry about it.

 

[TheWritingGroup]

Everyone above is right. Just to clarify: that's URL-encoded text, a standard way of removing potentially risky characters like quotation marks and spaces (without losing information), because in the wrong place it's possible for the server to interpret them as code and execute commands the owner doesn't want. It's the attack vector known as "code injection".

 

[CalBishForNow]

Relevant XKCD.

 

[SabrinaTheDabbler]

It's a cosmetic error. Most punctuation and symbols get transformed into their special character verison before they're added to the database. It's a base level of protecting against attempts to inject malicious code through a form. The only thing "wrong" here is that it wasn't reversed for display in the preview form. Odds are it is on the backend, so all Laurel sees are the expected symbols. And if not, that particular moderator note will likely encourage Laurel to have Manu drop the code snippet in there to do it. LOL

It will have zero impact on the submission process beyond you not being able to review your moderator note without your eyes going crossed.

That's very reassuring to know, thank you!

It's bothersome on its own, because it seems like a genuinely "easy" fix. But it's EXTRA bothersome to look at because it's so damn longer than you'd expect, lol, just as you said as well.

 

[SabrinaTheDabbler]

Everyone above is right. Just to clarify: that's URL-encoded text, a standard way of removing potentially risky characters like quotation marks and spaces (without losing information), because in the wrong place it's possible for the server to interpret them as code and execute commands the owner doesn't want. It's the attack vector known as "code injection".

I guess I'm just surprised that apostrophes and quotations marks specifically are the focus, as I would have expected colons and slashes and the like to be the issue, instead, for some reason.

Thank you!

 

[deathlynx]

Relevant XKCD.

Okay, now I know I've been hanging around comp-sci geeks for too much of my life. That was hysterical!

 

[IWroteThis]

I guess I'm just surprised that apostrophes and quotations marks specifically are the focus, as I would have expected colons and slashes and the like to be the issue, instead, for some reason.

Thank you!

Quotation marks that aren't properly handled can close a set of quotation marks in the code, causing the rest of the string to be treated as code instead of data. A lot of programming languages use double quotes for text strings, but all SQL variants use single quotes (aka apostrophes) for them.

Likewise > can close out an existing tag, then < can open a new, malicious one.

Other characters, such as colons and slashes can be used once the compromise is accomplished, but they won't break the string handling by themselves.

 

[TheLobster]

I guess I'm just surprised that apostrophes and quotations marks specifically are the focus, as I would have expected colons and slashes and the like to be the issue, instead, for some reason.

It’s because this isn’t actually URL encoding, it’s HTML escaping; and the characters that are most likely to mess up HTML are angle brackets (< in particular) and both single and double quotes, so they has to be replaced with ampersand sequences like &lt; or &quot; to be rendered verbatim.

The problem is that Lit seems to do this escaping twice for notes to the admin, and not only that but it also forgets the unescaped form when you navigate back to the form from the preview. Sloppy coding all around, and it’s been like this for years.