escape html in opengraph properties

damus-io · Dec 21, 2023 · b86a552 · b86a552
1 parent 3971be3
commit b86a552
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/src/main.rs b/src/main.rs
@@ -1,5 +1,6 @@
 use std::net::SocketAddr;
 
+use html_escape;
 use http_body_util::Full;
 use hyper::body::Bytes;
 use hyper::header;
@@ -155,8 +156,9 @@ fn serve_note_html(
     // 4: Full content
 
     let hostname = "https://damus.io";
-    let abbrev_content = abbreviate(&note.note.content, 64);
-    let content = &note.note.content;
+    let abbrev_content = html_escape::encode_text(abbreviate(&note.note.content, 64));
+    let content = html_escape::encode_text(&note.note.content);
+    let profile_name = html_escape::encode_text(&note.profile.name);
 
     write!(
         data,
@@ -192,7 +194,7 @@ fn serve_note_html(
         </body>
         </html>
         "#,
-        note.profile.name,
+        profile_name,
         abbrev_content,
         hostname,
         nip19.to_bech32().unwrap(),