discourse/lib/onebox
Loïc Guitaut caaa8f9c9e
FIX: Don't escape HTML entities twice in oneboxes (#37141)
Sometimes, HTML entities can be escaped twice, typically when getting
sanitized data from our `Onebox::OpenGraph` class then providing that
value to a template. We’re using the Mustache gem to process the Onebox
templates, and it will automatically escape HTML entities. This is
usually not a problem, but it is for things like ampersands. For
example, if the value we provide to the template is `&`, then
Mustache will convert it to `&`.

This patch fixes that behavior by decoding the result of the sanitization
we apply in `Onebox::OpenGraph`. That way, templates will get `&`
instead of `&`, thus there won’t be any double escaping.
2026-01-16 11:40:18 +01:00
..
engine FIX: skip image dimensions in oembed for rich data types (#37108) 2026-01-15 11:45:53 +04:00
mixins FEATURE: GitHub PR live status icon (#36313) 2025-12-04 21:42:44 +01:00
templates UX: Show contextual dates on GitHub PR oneboxes (#36637) 2025-12-11 20:10:24 +01:00
domain_checker.rb DEV: Fix various rubocop lints (#24749) 2023-12-06 23:25:00 +01:00
engine.rb SECURITY: Restrict allowed URL patterns 2025-02-04 13:32:34 -03:00
file_type_finder.rb
helpers.rb FIX: Plus encoding (+) was not handled correctly in onebox and UI (#36822) 2025-12-23 14:32:22 +11:00
json_ld.rb DEV: Replace custom Onebox blank implementation with ActiveSupport (#23827) 2023-10-07 19:54:26 +02:00
layout.rb DEV: Replace custom Onebox symbolize_keys implementation with ActiveSupport (#23828) 2023-10-09 09:32:09 +02:00
layout_support.rb
matcher.rb
movie.rb
normalizer.rb FIX: Don't escape HTML entities twice in oneboxes (#37141) 2026-01-16 11:40:18 +01:00
oembed.rb DEV: Replace custom Onebox symbolize_keys implementation with ActiveSupport (#23828) 2023-10-09 09:32:09 +02:00
open_graph.rb DEV: Replace custom Onebox blank implementation with ActiveSupport (#23827) 2023-10-07 19:54:26 +02:00
preview.rb DEV: Remove logical OR assignment of constants (#29201) 2024-10-16 10:09:07 +08:00
sanitize_config.rb DEV: Bump rubocop_discourse (#29608) 2024-11-06 06:27:49 +08:00
status_check.rb
template_support.rb
view.rb