# Improper HTML escaping in bot view

**URL:** https://meta.discourse.org/t/improper-html-escaping-in-bot-view/66606
**Category:** Bug
**Created:** [21 Luglio 2017, 6:20pm UTC](https://meta.discourse.org/t/improper-html-escaping-in-bot-view/66606 "2017-07-21T18:20:30Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![elijah](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/elijah/32/104055_2.png) [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [21 Luglio 2017, 6:20pm UTC](https://meta.discourse.org/t/improper-html-escaping-in-bot-view/66606/1 "2017-07-21T18:20:30Z")

</div>

I noticed this on @y2k’s site, [https://army.community/](https://army.community/), and have since seen it on some other sites, like [https://discuss.codecademy.com/](https://discuss.codecademy.com/).

I visited Y2k’s site in lynx, to check connectivity (turns out it was down). Later when it came back up, I visited again in lynx and saw HTML tags on the page. Tags that were not visible when I visited in a browser that knows Javascript.

Here’s what I’m seeing right now on Codeacademy’s top level page in lynx:

```plaintext
JavaScript

   JavaScript is an essential web technology, adding interactivity to the
   structure and style of <a
   href="https://discuss.codecademy.com/c/web">HTML and CSS</a>. This
   forum category covers the Codecademy courses <a
   href="https://www.codecademy.com/learn/learn-javascript?utm_source=foru
   ms_to_main&amp;utm_medium=category_description">Learn JavaScript</a>
   and <a
   href="https://www.codecademy.com/learn/javascript?utm_source=forums_to_
   main&amp;utm_medium=category_description">JavaScript</a>.

```

Visiting the page in Firefox, those links are actually links, not escaped HTML.This view of the page won’t be seen by most humans, but will be seen by at least some bots. The escaped html is visible in ‘view source’ in Firefox (long line wrapped)

```html
<span itemprop='description'>JavaScript is an essential web technology, adding
interactivity to the structure and style of &lt;a
href=&quot;https://discuss.codecademy.com/c/web&quot;&gt;HTML and
CSS&lt;/a&gt;. This forum category covers the Codecademy courses &lt;a
href=&quot;https://www.codecademy.com/learn/learn-javascript?utm_source=forums_to_main&amp;amp;utm_medium=category_description&quot;&gt;Learn
JavaScript&lt;/a&gt; and &lt;a
href=&quot;https://www.codecademy.com/learn/javascript?utm_source=forums_to_main&amp;amp;utm_medium=category_description&quot;&gt;JavaScript&lt;/a&gt;.</span>

```

(Separately, I’m wondering what the syntax highlighter thinks it is doing here. I’ve specified “html” on the code fence.)

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [21 Luglio 2017, 10:52pm UTC](https://meta.discourse.org/t/improper-html-escaping-in-bot-view/66606/2 "2017-07-21T22:52:10Z")

</div>

This might be a good one for you to try to fix locally, under our current arrangement?

---

<div class="post-metadata">

### Author: ![elijah](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/elijah/32/104055_2.png) [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [21 Luglio 2017, 10:53pm UTC](https://meta.discourse.org/t/improper-html-escaping-in-bot-view/66606/3 "2017-07-21T22:53:12Z")

</div>

Yes, I can start looking at it later tonight.

---

<div class="post-metadata">

### Author: ![elijah](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/elijah/32/104055_2.png) [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [24 Luglio 2017, 11:36pm UTC](https://meta.discourse.org/t/improper-html-escaping-in-bot-view/66606/4 "2017-07-24T23:36:09Z")

</div>

Changing `c.description` to `c.description.html_safe` here fixes it by letting html through

> <https://github.com/discourse/discourse/blob/main/app/views/categories/index.html.erb#L9>

Or changing `c.description` to `c.description_text` fixes it by making it plain text. I’m guessing the `.html_safe` version is the preferred one, but I can give you a pull request with either.

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [24 Luglio 2017, 11:39pm UTC](https://meta.discourse.org/t/improper-html-escaping-in-bot-view/66606/5 "2017-07-24T23:39:09Z")

</div>

`html_safe` is fine here 😉

---

<div class="post-metadata">

### Author: ![elijah](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/elijah/32/104055_2.png) [@elijah](https://meta.discourse.org/u/elijah)
#### Post date: [25 Luglio 2017, 12:19am UTC](https://meta.discourse.org/t/improper-html-escaping-in-bot-view/66606/6 "2017-07-25T00:19:09Z")

</div>

> <https://github.com/discourse/discourse/pull/4989>
>
> This will let links in descriptions actually work. Yay.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [5 Maggio 2018, 8:35pm UTC](https://meta.discourse.org/t/improper-html-escaping-in-bot-view/66606/7 "2018-05-05T20:35:08Z")

</div>


