From 9564257564e417e18bdeedded9397d469e6daf14 Mon Sep 17 00:00:00 2001
From: Stephen Zhou <38493346+hyoban@users.noreply.github.com>
Date: Wed, 30 Oct 2024 11:20:38 +0800
Subject: [PATCH] fix: escape for seo meta tags

close #1232
---
 apps/server/src/lib/seo.ts | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/lib/seo.ts b/apps/server/src/lib/seo.ts
index 37da125e3..ef1caaffd 100644
--- a/apps/server/src/lib/seo.ts
+++ b/apps/server/src/lib/seo.ts
@@ -1,3 +1,17 @@
+function escapeHtml(unsafe?: string | null) {
+  if (!unsafe) {
+    return unsafe
+  }
+
+  return unsafe
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&#x27;")
+    .replaceAll("/", "&#x2F;")
+}
+
 export function buildSeoMetaTags(configs: {
   openGraph: {
     title: string
@@ -5,7 +19,11 @@ export function buildSeoMetaTags(configs: {
     image?: string | null
   }
 }) {
-  const { openGraph } = configs
+  const openGraph = {
+    title: escapeHtml(configs.openGraph.title),
+    description: escapeHtml(configs.openGraph.description),
+    image: escapeHtml(configs.openGraph.image),
+  }
   const title = `${openGraph.title} | Follow`
   return [
     `<meta property="og:title" content="${title}" />`,