Software Update dialog on macOS displays raw HTML in the Release Notes box

[robyoder]

Test plan

1. Do install as non-admin user on macOS for an older version of Brave, as described in Software update popup should not be presented during Sparkle update process #9562 (comment)
2. Check for updates
3. Update modal should not have HTML in it

Original issue description

Tried searching for: changelog, release notes, HTML, updater, macos

Description

Automatic updates for Brave on macOS have raw HTML displayed in the release notes box, and it's been this way as long as I can remember. I assumed it was an oversight and would be fixed eventually but it hasn't been yet.

Steps to Reproduce

1. Get a notification of an update to Brave.

Actual result:

Expected result:

That the HTML would be rendered, not displayed raw.

Reproduces how often:

Easily reproduced

Brave version (brave://version info)

80.1.5.123

Version/Channel Information:

• Can you reproduce this issue with the current release? Yes
• Can you reproduce this issue with the beta channel? Not sure
• Can you reproduce this issue with the dev channel? Not sure
• Can you reproduce this issue with the nightly channel? Not sure

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields? No
• Does the issue resolve itself when disabling Brave Rewards? No
• Is the issue reproducible on the latest version of Chrome? No

[bsclifton]

@robyoder interesting- I don't think it's supposed to be showing updates like this. The regular expected behavior will happen if you uninstall brave and reinstall from https://brave.com/downloads. I'm guessing you've been using Brave for a while- we likely fixed the bug that caused this modal to show for updates 😄

Let me know if you're able to try remove/install. You won't lose any profile data by doing that - but in case you wanted to back up your profile, it's at ~/Library/Application Support/BraveSoftware/Brave-Browser

[robyoder]

Given that I can't test the updater immediately if I download the latest version, I did the following:

1. Deleted "Brave Browser.app" from my Applications folder and empty the trash.
2. Downloaded the previous stable release (Brave-Browser.dmg) here: https://github.com/brave/brave-browser/releases/tag/v1.7.92
3. Copied the app from the disk image to my Applications folder.
4. Opened the app and went to "About Brave" to check for updates.

This window appeared:

It sounds like you are expecting the updates to happen automatically without any window at all, similar to Chrome's updates. Perhaps this could be related to the fact that I don't run as an administrator account on macOS? But Chrome is able to autoupdate itself without problems, so it has to be possible.

[bsclifton]

Interesting- thanks for sharing, @robyoder 😄 This may indeed be because you're not running as Admin. We'll need to do more debugging

If this is an expected case, maybe we can clean up the text, as you suggest 😄

[mbacchi]

There are 2 separate issues being discussed here I believe. The original issue was opened because there was raw html in the popup. The second is regarding the fact that the user is presented with a popup window in order to update Brave, which should be tracked separately.

I've opened issue #9562 to track this second issue.

Regarding the raw html, that comes directly from the upload to the updates server, we pass in the content and I assumed it would render html. It obviously does not, so we can try to fix that.

[mbacchi]

Looking into this a bit more, Sparkle indicates that they pass the Release Notes string to a webview. So it should be able to format HTML.

The release_notes field in omaha-server on the other hand stores the release notes as a Django models.TextField, but if that is passed to Sparkle as a string the webview should render it. Unfortunately Sparkle does not render the URL properly.

I've tested this with HTML and plain text and neither appear to cause the URL to be rendered as a link.

The workaround may be to remove the Brave Browser version: x.x.x.x part of that field, because the version number is provided at the top of that popup. Instead we'll just put the Brave Browser Changelog: https://github.com/brave/brave-browser/blob/master/CHANGELOG_DESKTOP.md so that it is the only thing in the popup text box, and users can cut & paste the URL for now.

@simonhong do you have any ideas about how we can make this string behave as a hyperlink?

[bsclifton]

Fixed with brave/brave-core#5519

[kjozwiak]

Verification PASSED on macOS 10.13.6 High Sierra x64 using the following build:

Brave | 1.10.79 Chromium: 81.0.4044.138 (Official Build) dev (64-bit)
-- | --
Revision | 8c6c7ba89cc9453625af54f11fd83179e23450fa-refs/branch-heads/4044@{#999}
OS | macOS Version 10.13.6 (Build 17G11023)

• ensured that raw HTML was being used under the release note textbox
• ensured that Install Update worked as expected (made sure authentication was needed)
• ensured that the prompt reappears once visiting brave://settings/help and Remind Me Later was clicked
• ensured that the prompt doesn't reappear when visiting brave://settings/help and Skip This Version was clicked

Verification PASSED on macOS 10.15.5 Catalina x64 using the following build:

Brave | 1.10.79 Chromium: 81.0.4044.138 (Official Build) dev (64-bit)
-- | --
Revision | 8c6c7ba89cc9453625af54f11fd83179e23450fa-refs/branch-heads/4044@{#999}
OS | macOS Version 10.15.5 (Build 19F101)

• ensured that raw HTML was being used under the release note textbox
• ensured that Install Update worked as expected (made sure authentication was needed)
• ensured that the prompt reappears once visiting brave://settings/help and Remind Me Later was clicked
• ensured that the prompt doesn't reappear when visiting brave://settings/help and Skip This Version was clicked