KSP-SpaceDock/SpaceDock

[Bug] Modpack descriptions not escaped in `og:description` meta

Closed this issue · 0 comments

Problem

Modpack descriptions that contain quotes (or just links, which have quotes added automatically somehow) can terminate the og:description tag prematurely and inject markup into the page:

https://spacedock.info/pack/397/Cuinq

image

<meta property="og:description" content="{{ mod_list.description | first_paragraphs | bleach }}">

We're using bleach there, which should at least block potentially harmful scripts.

Suggestions

The description needs to be rendered to fit in an HTML attribute (quotes replaced with something else).

We might be able to do that by adding | escape?

https://bleach.readthedocs.io/en/latest/clean.html

If you need to use the output of bleach.clean() in an HTML attribute, you need to pass it through your template library’s escape function. For example, Jinja2’s escape or django.utils.html.escape or something like that.

https://jinja.palletsprojects.com/en/3.0.x/templates/#jinja-filters.escape

We should consider adding this to most of the other tags added in #385, just in case. I haven't found other problems yet, but trusting user-edited data is risky.