diff --git a/application/src/main/java/run/halo/app/theme/dialect/ContentTemplateHeadProcessor.java b/application/src/main/java/run/halo/app/theme/dialect/ContentTemplateHeadProcessor.java index 38ecf8191..55c89c665 100644 --- a/application/src/main/java/run/halo/app/theme/dialect/ContentTemplateHeadProcessor.java +++ b/application/src/main/java/run/halo/app/theme/dialect/ContentTemplateHeadProcessor.java @@ -10,6 +10,7 @@ import java.util.Map; import lombok.AllArgsConstructor; import org.apache.commons.lang3.StringUtils; import org.springframework.stereotype.Component; +import org.springframework.web.util.HtmlUtils; import org.thymeleaf.context.ITemplateContext; import org.thymeleaf.model.IModel; import org.thymeleaf.model.IModelFactory; @@ -70,18 +71,19 @@ public class ContentTemplateHeadProcessor implements TemplateHeadProcessor { static List> excerptToMetaDescriptionIfAbsent( List> htmlMetas, String excerpt) { - final String excerptNullSafe = StringUtils.defaultString(excerpt); + String excerptNullSafe = StringUtils.defaultString(excerpt); + final String excerptSafe = HtmlUtils.htmlEscape(excerptNullSafe); List> metas = new ArrayList<>(defaultIfNull(htmlMetas, List.of())); metas.stream() .filter(map -> Meta.DESCRIPTION.equals(map.get(Meta.NAME))) .distinct() .findFirst() .ifPresentOrElse(map -> - map.put(Meta.CONTENT, defaultIfBlank(map.get(Meta.CONTENT), excerptNullSafe)), + map.put(Meta.CONTENT, defaultIfBlank(map.get(Meta.CONTENT), excerptSafe)), () -> { Map map = new HashMap<>(); map.put(Meta.NAME, Meta.DESCRIPTION); - map.put(Meta.CONTENT, excerptNullSafe); + map.put(Meta.CONTENT, excerptSafe); metas.add(map); }); return metas;