diff --git a/CHANGELOG.md b/CHANGELOG.md index e980654a6..8ffb00d23 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -117,6 +117,7 @@ * Fix player settings menu keyboard navigation * Fix player placeholder width * Fix playlist miniature size with big description + * Correctly escape meta tags ## v3.4.1 diff --git a/server/lib/client-html.ts b/server/lib/client-html.ts index 84eb33348..b2948254b 100644 --- a/server/lib/client-html.ts +++ b/server/lib/client-html.ts @@ -2,6 +2,7 @@ import express from 'express' import { readFile } from 'fs-extra' import { join } from 'path' import validator from 'validator' +import { toCompleteUUID } from '@server/helpers/custom-validators/misc' import { escapeHTML } from '@shared/core-utils/renderer' import { HTMLServerConfig } from '@shared/models' import { buildFileLocale, getDefaultLocale, is18nLocale, POSSIBLE_LOCALES } from '../../shared/core-utils/i18n/i18n' @@ -27,7 +28,6 @@ import { VideoChannelModel } from '../models/video/video-channel' import { VideoPlaylistModel } from '../models/video/video-playlist' import { MAccountActor, MChannelActor } from '../types/models' import { ServerConfigManager } from './server-config-manager' -import { toCompleteUUID } from '@server/helpers/custom-validators/misc' type Tags = { ogType: string @@ -38,11 +38,12 @@ type Tags = { numberOfItems: number } - siteName: string - title: string + escapedSiteName: string + escapedTitle: string + escapedDescription: string + url: string originUrl: string - description: string disallowIndexation?: boolean @@ -100,15 +101,15 @@ class ClientHtml { res.status(HttpStatusCode.NOT_FOUND_404) return html } + const description = mdToPlainText(video.description) - let customHtml = ClientHtml.addTitleTag(html, escapeHTML(video.name)) - customHtml = ClientHtml.addDescriptionTag(customHtml, mdToPlainText(video.description)) + let customHtml = ClientHtml.addTitleTag(html, video.name) + customHtml = ClientHtml.addDescriptionTag(customHtml, description) const url = WEBSERVER.URL + video.getWatchStaticPath() const originUrl = video.url - const title = escapeHTML(video.name) - const siteName = escapeHTML(CONFIG.INSTANCE.NAME) - const description = mdToPlainText(video.description) + const title = video.name + const siteName = CONFIG.INSTANCE.NAME const image = { url: WEBSERVER.URL + video.getPreviewStaticPath() @@ -128,9 +129,9 @@ class ClientHtml { customHtml = ClientHtml.addTags(customHtml, { url, originUrl, - siteName, - title, - description, + escapedSiteName: escapeHTML(siteName), + escapedTitle: escapeHTML(title), + escapedDescription: escapeHTML(description), image, embed, ogType, @@ -161,14 +162,15 @@ class ClientHtml { return html } - let customHtml = ClientHtml.addTitleTag(html, escapeHTML(videoPlaylist.name)) - customHtml = ClientHtml.addDescriptionTag(customHtml, mdToPlainText(videoPlaylist.description)) + const description = mdToPlainText(videoPlaylist.description) + + let customHtml = ClientHtml.addTitleTag(html, videoPlaylist.name) + customHtml = ClientHtml.addDescriptionTag(customHtml, description) const url = WEBSERVER.URL + videoPlaylist.getWatchStaticPath() const originUrl = videoPlaylist.url - const title = escapeHTML(videoPlaylist.name) - const siteName = escapeHTML(CONFIG.INSTANCE.NAME) - const description = mdToPlainText(videoPlaylist.description) + const title = videoPlaylist.name + const siteName = CONFIG.INSTANCE.NAME const image = { url: videoPlaylist.getThumbnailUrl() @@ -190,10 +192,10 @@ class ClientHtml { customHtml = ClientHtml.addTags(customHtml, { url, originUrl, - siteName, + escapedSiteName: escapeHTML(siteName), + escapedTitle: escapeHTML(title), + escapedDescription: escapeHTML(description), embed, - title, - description, image, list, ogType, @@ -259,14 +261,15 @@ class ClientHtml { return ClientHtml.getIndexHTML(req, res) } - let customHtml = ClientHtml.addTitleTag(html, escapeHTML(entity.getDisplayName())) - customHtml = ClientHtml.addDescriptionTag(customHtml, mdToPlainText(entity.description)) + const description = mdToPlainText(entity.description) + + let customHtml = ClientHtml.addTitleTag(html, entity.getDisplayName()) + customHtml = ClientHtml.addDescriptionTag(customHtml, description) const url = entity.getLocalUrl() const originUrl = entity.Actor.url - const siteName = escapeHTML(CONFIG.INSTANCE.NAME) - const title = escapeHTML(entity.getDisplayName()) - const description = mdToPlainText(entity.description) + const siteName = CONFIG.INSTANCE.NAME + const title = entity.getDisplayName() const image = { url: entity.Actor.getAvatarUrl(), @@ -281,9 +284,9 @@ class ClientHtml { customHtml = ClientHtml.addTags(customHtml, { url, originUrl, - title, - siteName, - description, + escapedTitle: escapeHTML(title), + escapedSiteName: escapeHTML(siteName), + escapedDescription: escapeHTML(description), image, ogType, twitterCard, @@ -367,14 +370,14 @@ class ClientHtml { let text = title || CONFIG.INSTANCE.NAME if (title) text += ` - ${CONFIG.INSTANCE.NAME}` - const titleTag = `