오ops 페이지 주제 제목의 `’` 문제

Moin · 6월 28, 2026, 1:47오후

오ops 페이지의 인기 주제 목록(예: https://meta.discourse.org/oops)에서 일부 제목에 ' 대신 ’가 표시됩니다.

Lilly · 6월 28, 2026, 5:03오후

이거 웃기다 (그리고 아마 관련이 있을 것 같다)

sam · 6월 29, 2026, 4:01오전

네, 이 문제는 아마도 보안 패치에서 비롯되었을 가능성이 큽니다. 인젝션 공격 때문에 여기서는 특히 더 신중해야 합니다.

zogstrip · 6월 29, 2026, 2:17오후

이건 어떻게 생각하세요 @sam?

github.com/discourse/discourse

FIX: Prevent double-escaping of HTML entities in titles and meta descriptions (#41261)

main ← fix-double-escape-entities

merged 06:26PM - 02 Jul 26 UTC

ZogStriP

+167 -13

Previously, content that was already HTML-escaped — topic `fancy_title`s on the …404/oops pages, GitHub onebox labels, and topic/group/category `<meta>` descriptions — got escaped a second time, so readers (and crawlers) saw literal entities like `’` and `&` instead of `'` and `&`. This change escapes every value exactly once, by converting it to plain text before it reaches the renderer instead of flagging anything `html_safe`: - `Emoji.codes_to_img` escapes its text segments with `html_escape_once` so the already-escaped `fancy_title` and sanitized GitHub labels aren't escaped again. All of its callers render into element content, and the attribute escaping inside `emoji_img_tag` is untouched. - the new `ExcerptParser.to_plain_text` converts a stored excerpt (escaped text, the `…` truncation marker, and the hashtag placeholder markup the parser keeps) back to plain text, exposed as `Topic#plain_text_excerpt`. It's a tag-strip plus a memoized `htmlentities` decode — pure Ruby, a few microseconds per excerpt, no Nokogiri in the hot path. - `Category#plain_text_description` caches the pre-escape plain text that `description_text` previously discarded, and the category meta descriptions use it directly. This also fixes the double-escaped `og:description`/`twitter:description` on category pages, where `gsub_emoji_to_unicode` silently drops the `html_safe` flag of `description_text`. - the new `Group#bio_summary` mirrors `UserProfile#bio_summary`: a plain-text excerpt of the bio with links and images stripped and hashtags rendered as plain `#slug`. Marking the stored values `html_safe` would have worked for the column data — every writer of `topics.excerpt` escapes — but `topic.excerpt` can be swapped in-memory with a localized excerpt that isn't guaranteed to be escaped, so treating everything as unsafe plain text is both simpler and safer.

zogstrip · 7월 6, 2026, 6:00오전

이 주제는 3일 후 자동으로 닫혔습니다. 더 이상 새 답변을 남길 수 없습니다.

글		댓글	조회수
<span class="search-highlight"> showing up in search results Bug	2	366	11월 28, 2023
Discourse escaping & in Onebox Bug onebox	3	181	1월 16, 2026
HTML entities not being parsed in featured topic title on profile Bug	4	672	2월 4, 2020
Notifications menu shows raw backslash escapes in titles Bug	10	1425	3월 13, 2017
Pasting a link in the composer's title field trims the title if there's a quote character in it Bug	2	543	6월 8, 2022

오ops 페이지 주제 제목의 `&rsquo;` 문제

Related topics

오ops 페이지 주제 제목의 `’` 문제