From 074f352709c024a04261ebb007dce6772c9eb243 Mon Sep 17 00:00:00 2001 From: Daenney Date: Wed, 22 Feb 2023 22:36:18 +0100 Subject: [chore] improve opengraph descripiton tag (#1550) This changes parseDescription to properly encode things to be safe for usage without removing things like backslashes that may be relevant. * text.SanitizePlaintext already calls html.UnescapeString so we don't have to do that * Replace \n with space early * Remove duplicate white-space by splitting on fields and joining * HTML-escape the string we have * For extra certainty, encode the backslash as \ Fixes #1549 --- internal/web/opengraph.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'internal/web/opengraph.go') diff --git a/internal/web/opengraph.go b/internal/web/opengraph.go index 9636e408f..6fcc524cd 100644 --- a/internal/web/opengraph.go +++ b/internal/web/opengraph.go @@ -134,11 +134,11 @@ func parseTitle(account *apimodel.Account, accountDomain string) string { // parseDescription returns a string description which is // safe to use as a template.HTMLAttr inside templates. func parseDescription(in string) string { - i := html.UnescapeString(in) - i = text.SanitizePlaintext(i) - i = strings.ReplaceAll(i, "\"", "'") - i = strings.ReplaceAll(i, `\`, "") + i := text.SanitizePlaintext(in) i = strings.ReplaceAll(i, "\n", " ") + i = strings.Join(strings.Fields(i), " ") + i = html.EscapeString(i) + i = strings.ReplaceAll(i, `\`, "\") i = trim(i, maxOGDescriptionLength) return `content="` + i + `"` } -- cgit v1.2.3