# "’" nei titoli degli argomenti nella pagina oops
**URL:** https://meta.discourse.org/t/rsquo-in-topic-titles-on-oops-page/406309
**Category:** Bug
**Tags:** fixed
**Created:** [28 Giugno 2026, 1:47pm UTC](https://meta.discourse.org/t/rsquo-in-topic-titles-on-oops-page/406309 "2026-06-28T13:47:12Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [28 Giugno 2026, 1:47pm UTC](https://meta.discourse.org/t/rsquo-in-topic-titles-on-oops-page/406309/1 "2026-06-28T13:47:12Z")
Nell’elenco degli argomenti popolari nella pagina oops (ad esempio [https://meta.discourse.org/oops](https://meta.discourse.org/oops)), alcuni titoli mostrano `’` invece di `'`.
---
### Author:  [@Lilly](https://meta.discourse.org/u/Lilly)
#### Post date: [28 Giugno 2026, 5:03pm UTC](https://meta.discourse.org/t/rsquo-in-topic-titles-on-oops-page/406309/2 "2026-06-28T17:03:06Z")
questo è divertente (e probabilmente correlato)
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [29 Giugno 2026, 4:01am UTC](https://meta.discourse.org/t/rsquo-in-topic-titles-on-oops-page/406309/3 "2026-06-29T04:01:15Z")
sì, questo probabilmente derivava da una correzione di sicurezza, dobbiamo fare particolare attenzione qui a causa delle iniezioni
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [29 Giugno 2026, 2:17pm UTC](https://meta.discourse.org/t/rsquo-in-topic-titles-on-oops-page/406309/5 "2026-06-29T14:17:45Z")
Che ne pensi di questo @sam?
>
>
> Previously, content that was already HTML-escaped — topic \`fancy\_title\`s on the …404/oops pages, GitHub onebox labels, and topic/group/category \`\\` descriptions — got escaped a second time, so readers (and crawlers) saw literal entities like \`’\` and \`&\` instead of \`'\` and \`&\`.
>
> This change escapes every value exactly once, by converting it to plain text before it reaches the renderer instead of flagging anything \`html\_safe\`:
>
> \- \`Emoji.codes\_to\_img\` escapes its text segments with \`html\_escape\_once\` so the already-escaped \`fancy\_title\` and sanitized GitHub labels aren't escaped again. All of its callers render into element content, and the attribute escaping inside \`emoji\_img\_tag\` is untouched.
> \- the new \`ExcerptParser.to\_plain\_text\` converts a stored excerpt (escaped text, the \`…\` truncation marker, and the hashtag placeholder markup the parser keeps) back to plain text, exposed as \`Topic#plain\_text\_excerpt\`. It's a tag-strip plus a memoized \`htmlentities\` decode — pure Ruby, a few microseconds per excerpt, no Nokogiri in the hot path.
> \- \`Category#plain\_text\_description\` caches the pre-escape plain text that \`description\_text\` previously discarded, and the category meta descriptions use it directly. This also fixes the double-escaped \`og:description\`/\`twitter:description\` on category pages, where \`gsub\_emoji\_to\_unicode\` silently drops the \`html\_safe\` flag of \`description\_text\`.
> \- the new \`Group#bio\_summary\` mirrors \`UserProfile#bio\_summary\`: a plain-text excerpt of the bio with links and images stripped and hashtags rendered as plain \`#slug\`.
>
> Marking the stored values \`html\_safe\` would have worked for the column data — every writer of \`topics.excerpt\` escapes — but \`topic.excerpt\` can be swapped in-memory with a localized excerpt that isn't guaranteed to be escaped, so treating everything as unsafe plain text is both simpler and safer.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [6 Luglio 2026, 6:00am UTC](https://meta.discourse.org/t/rsquo-in-topic-titles-on-oops-page/406309/6 "2026-07-06T06:00:30Z")
Questo argomento è stato chiuso automaticamente dopo 3 giorni. Non sono più consentite nuove risposte.