# HTML 实体未在个人资料的主题标题中解析

**URL:** https://meta.discourse.org/t/html-entities-not-being-parsed-in-featured-topic-title-on-profile/140546
**Category:** Bug
**Created:** [2020年二月4日 06:08 UTC](https://meta.discourse.org/t/html-entities-not-being-parsed-in-featured-topic-title-on-profile/140546 "2020-02-04T06:08:40Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![angus](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/angus/32/341715_2.png) [@angus](https://meta.discourse.org/u/angus)
#### Post date: [2020年二月4日 06:08 UTC](https://meta.discourse.org/t/html-entities-not-being-parsed-in-featured-topic-title-on-profile/140546/1 "2020-02-04T06:08:41Z")

</div>

用户资料中的精选主题标题未正确解析 HTML 实体，例如：

```plaintext
How to start building stuff for Discourse if you&rsquo;re newbie (like myself)

```

参见：[Profile - angus - Discourse Meta](https://meta.discourse.org/u/angus)

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2020年二月4日 06:11 UTC](https://meta.discourse.org/t/html-entities-not-being-parsed-in-featured-topic-title-on-profile/140546/2 "2020-02-04T06:11:06Z")

</div>

也许可以@markvanlan 试试？

---

<div class="post-metadata">

### Author: ![markvanlan](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/markvanlan/32/160087_2.png) [@markvanlan](https://meta.discourse.org/u/markvanlan)
#### Post date: [2020年二月4日 15:38 UTC](https://meta.discourse.org/t/html-entities-not-being-parsed-in-featured-topic-title-on-profile/140546/4 "2020-02-04T15:38:26Z")

</div>

我刚刚合并了 [一个提交](https://github.com/discourse/discourse/pull/8850/commits/3862e7dd129970ac15a7708f52a7569bade4afd6) 来修复这个问题。只是一对额外的 `{}`！

---

<div class="post-metadata">

### Author: ![markvanlan](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/markvanlan/32/160087_2.png) [@markvanlan](https://meta.discourse.org/u/markvanlan)
#### Post date: [2020年二月4日 15:38 UTC](https://meta.discourse.org/t/html-entities-not-being-parsed-in-featured-topic-title-on-profile/140546/5 "2020-02-04T15:38:36Z")

</div>



---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2020年二月4日 15:39 UTC](https://meta.discourse.org/t/html-entities-not-being-parsed-in-featured-topic-title-on-profile/140546/6 "2020-02-04T15:39:30Z")

</div>

如果主题标题中包含 HTML 代码，我们是否确定这不会让我们面临 XSS 漏洞的风险？

---

<div class="post-metadata">

### Author: ![markvanlan](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/markvanlan/32/160087_2.png) [@markvanlan](https://meta.discourse.org/u/markvanlan)
#### Post date: [2020年二月4日 15:53 UTC](https://meta.discourse.org/t/html-entities-not-being-parsed-in-featured-topic-title-on-profile/140546/7 "2020-02-04T15:53:25Z")

</div>

我确认 `fancy_title` 已进行转义，不会导致 XSS 漏洞。我之前只是假设如此，因此感谢您的提问。