From a56d4f2a926017b872ec67cc0637032145f731a6 Mon Sep 17 00:00:00 2001
From: contour <40132326+Contour-D@users.noreply.github.com>
Date: Sun, 4 Jun 2023 10:15:21 +0800
Subject: [PATCH] Fix the meta description with special characters causing the
 page to display abnormally (#4031)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!--  Thanks for sending a pull request!  Here are some tips for you:
1. 如果这是你的第一次，请阅读我们的贡献指南：<https://github.com/halo-dev/halo/blob/master/CONTRIBUTING.md>。
1. If this is your first time, please read our contributor guidelines: <https://github.com/halo-dev/halo/blob/master/CONTRIBUTING.md>.
2. 请根据你解决问题的类型为 Pull Request 添加合适的标签。
2. Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request.
3. 请确保你已经添加并运行了适当的测试。
3. Ensure you have added or ran the appropriate tests for your PR.
-->

#### What type of PR is this?

<!--
添加其中一个类别：
Add one of the following kinds:

/kind bug
/kind cleanup
/kind documentation
/kind feature
/kind improvement

适当添加其中一个或多个类别（可选）：
Optionally add one or more of the following kinds if applicable:

/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->
/kind bug
/area core

#### What this PR does / why we need it:
Fix the problem that the meta description with special characters causes the page to display abnormally.
Use htmlEscape in org.springframework.web.util.HtmlUtils to escape the special characters contained in the original description.

see #4000
#### Which issue(s) this PR fixes:

<!--
PR 合并时自动关闭 issue。
Automatically closes linked issue when PR is merged.

用法：`Fixes #<issue 号>`，或者 `Fixes (粘贴 issue 完整链接)`
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
-->
Fixes #4000

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?

<!--
如果当前 Pull Request 的修改不会造成用户侧的任何变更，在 `release-note` 代码块儿中填写 `NONE`。
否则请填写用户侧能够理解的 Release Note。如果当前 Pull Request 包含破坏性更新（Break Change），
Release Note 需要以 `action required` 开头。
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".
-->

```release-note
NONE
```
---
 .../app/theme/dialect/ContentTemplateHeadProcessor.java   | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/application/src/main/java/run/halo/app/theme/dialect/ContentTemplateHeadProcessor.java b/application/src/main/java/run/halo/app/theme/dialect/ContentTemplateHeadProcessor.java
index 38ecf8191..55c89c665 100644
--- a/application/src/main/java/run/halo/app/theme/dialect/ContentTemplateHeadProcessor.java
+++ b/application/src/main/java/run/halo/app/theme/dialect/ContentTemplateHeadProcessor.java
@@ -10,6 +10,7 @@ import java.util.Map;
 import lombok.AllArgsConstructor;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.stereotype.Component;
+import org.springframework.web.util.HtmlUtils;
 import org.thymeleaf.context.ITemplateContext;
 import org.thymeleaf.model.IModel;
 import org.thymeleaf.model.IModelFactory;
@@ -70,18 +71,19 @@ public class ContentTemplateHeadProcessor implements TemplateHeadProcessor {
     static List<Map<String, String>> excerptToMetaDescriptionIfAbsent(
         List<Map<String, String>> htmlMetas,
         String excerpt) {
-        final String excerptNullSafe = StringUtils.defaultString(excerpt);
+        String excerptNullSafe = StringUtils.defaultString(excerpt);
+        final String excerptSafe = HtmlUtils.htmlEscape(excerptNullSafe);
         List<Map<String, String>> metas = new ArrayList<>(defaultIfNull(htmlMetas, List.of()));
         metas.stream()
             .filter(map -> Meta.DESCRIPTION.equals(map.get(Meta.NAME)))
             .distinct()
             .findFirst()
             .ifPresentOrElse(map ->
-                    map.put(Meta.CONTENT, defaultIfBlank(map.get(Meta.CONTENT), excerptNullSafe)),
+                    map.put(Meta.CONTENT, defaultIfBlank(map.get(Meta.CONTENT), excerptSafe)),
                 () -> {
                     Map<String, String> map = new HashMap<>();
                     map.put(Meta.NAME, Meta.DESCRIPTION);
-                    map.put(Meta.CONTENT, excerptNullSafe);
+                    map.put(Meta.CONTENT, excerptSafe);
                     metas.add(map);
                 });
         return metas;