Invalid og:description

[TheAwiteb]

Hey, i think og:description should not have a html elements in it. for example this site

My description

مرحبآ انا **بوت** اخبار السعودية، راح انشر اخر اخبار صحيفة اخبار السعودية news50.sa 📰 🇸🇦

and it's looks like this

مرحبآ انا <strong>بوت</strong> اخبار السعودية، راح انشر اخر اخبار صحيفة اخبار السعودية <a href=&quot;http://news50.sa&quot;>news50.sa</a> 📰 🇸🇦

i think it's should be looks like this

مرحبآ انا بوت اخبار السعودية، راح انشر اخر اخبار صحيفة اخبار السعودية news50.sa 📰 🇸🇦

---

I'am new in @LemmyNet and i think the issue is here
https://github.com/LemmyNet/lemmy/blob/583ceb25063ce0d2fdd5f30708beb75e566d40a2/crates/api_common/src/request.rs#L71-L75

I want to fix it 🤍

[Nutomic]

I cant find anything definitive, but it makes sense that there should be no HTML, otherwise someone could also add a <script> tag with malicious code. Fixing it would require HTML escape, for example with this crate. But as we only need it in this place, it might be enough to replace those three characters manually, instead of pulling in another dependency.

[TheAwiteb]

I cant find anything definitive, but it makes sense that there should be no HTML, otherwise someone could also add a <script> tag with malicious code. Fixing it would require HTML escape, for example with this crate. But as we only need it in this place, it might be enough to replace those three characters manually, instead of pulling in another dependency.

I was solved with regex

But i want to know there is a another place to fix it? I will create a PR today

[Nutomic]

No, its the only place which does that. Though it would also be good to escape html in other opengraph fields like title, to avoid malicious javascript. Anyway, its easier to discuss all this in pull request review.

[dessalines]

The lemmy-ui front end doesn't render that, but yes its possible to sanitize that on the rust side of things. Make sure to use a rust crate tho to sanitize it like @Nutomic mentioned.

[TheAwiteb]

@Nutomic I try to fix it, but i don't know where the front gets the "og:description" from.

[TheAwiteb]

It's not from here, I tried to change it but it's still the same

https://github.com/LemmyNet/lemmy/blob/583ceb25063ce0d2fdd5f30708beb75e566d40a2/crates/api_common/src/request.rs#L71-L75

[Nutomic]

Did you test by creating a new post? Because description for existing posts wont get updated later.

[TheAwiteb]

Did you test by creating a new post? Because description for existing posts wont get updated later.

No, the bug in the user profile, this description is the bio of the user.

[Nutomic]

Can you post a link to the user profile? Im pretty sure og:description isnt used anywhere else besides the box below post.

[TheAwiteb]

Can you post a link to the user profile? Im pretty sure og:description isnt used anywhere else besides the box below post.

[TheAwiteb]

This is screenshot, i have create account in lemmy.ml, but is not approval yet, the username is test_for_2479

[Nutomic]

The bio field just shows what you enter manually under /settings. It definitely doesnt use og:description. Nevertheless, this issue needs to be fixed for post metadata.

[TheAwiteb]

See, i think telegram get the description from og:description or description i don't know, i think we should fix both.

The profile: u/test_for_2479

[TheAwiteb]

Of course the fix is not for telegram only, it's for all app that implement url view

[Nutomic]

Wait i though this issue was about Lemmy fetching og:description wrongly from other sites. But its really about Lemmy generating og:description wrong? In that case its done somewhere in lemmy-ui.

[TheAwiteb]

Wait i though this issue was about Lemmy fetching og:description wrongly from other sites. But its really about Lemmy generating og:description wrong? In that case its done somewhere in lemmy-ui.

I think lemmy-ui get it from the server, i don't know, we need to check before close the issue

[dessalines]

Okay I think I see what's going on.

lemmy-ui converts the markdown in bios and descriptions to html, so that it can be properly rendered by other sites.

https://github.com/LemmyNet/lemmy-ui/blob/main/src/shared/components/common/html-tags.tsx#L40

But this is probably incorrect, as the description field should be plain text. If markdown-it doesn't support that, then I can use something like https://www.npmjs.com/package/html-to-text to strip out the html tags.

@TheAwiteb don't worry I'll get this one, should only take a minute.