Merge pull request #3724 from dergigi/fix/decode-numeric-html-entities

fix: decode numeric HTML entities in link preview meta tags
2026-08-08 23:54:39 +00:00 · 2026-07-26 18:11:33 -04:00
parent a0cf0ec332 4cb0fb64af
commit 2a25dfee01
2 changed files with 68 additions and 3 deletions
@@ -20,6 +20,7 @@
 */
 package com.vitorpamplona.amethyst.commons.preview

+import com.vitorpamplona.amethyst.commons.util.codePointToChars
 import kotlinx.collections.immutable.toImmutableMap

 data class MetaTag(
@@ -179,13 +180,32 @@ object MetaTagsParser {
                )

            fun replaceCharRefs(match: MatchResult): String {
-                val bcr = BASE_CHAR_REFS[match.groupValues[2]]
+                val isNumeric = match.groupValues[1].isNotEmpty()
+                val ref = match.groupValues[2]
+                val terminated = match.groupValues[3].isNotEmpty()
+
+                // Numeric character references (&#34; / &#x22;) must be terminated by ';'
+                if (isNumeric) {
+                    if (!terminated) return match.value
+                    val codePoint =
+                        if (ref.startsWith("x", ignoreCase = true)) {
+                            ref.drop(1).toIntOrNull(16)
+                        } else {
+                            ref.toIntOrNull(10)
+                        } ?: return match.value
+                    if (codePoint !in 0..0x10FFFF || codePoint in 0xD800..0xDFFF) {
+                        return match.value
+                    }
+                    return codePointToChars(codePoint).concatToString()
+                }
+
+                val bcr = BASE_CHAR_REFS[ref]
                if (bcr != null) {
                    return bcr
                }
                // non-base char refs must be terminated by ';'
-                if (match.groupValues[3].isNotEmpty()) {
-                    val cr = CHAR_REFS[match.groupValues[2]]
+                if (terminated) {
+                    val cr = CHAR_REFS[ref]
                    if (cr != null) {
                        return cr
                    }
@@ -0,0 +1,45 @@
+/*
+ * Copyright (c) 2025 Vitor Pamplona
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to use,
+ * copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
+ * Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+ * AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+package com.vitorpamplona.amethyst.commons.preview
+
+import kotlin.test.Test
+import kotlin.test.assertEquals
+
+class MetaTagsParserCharRefTest {
+    @Test
+    fun decodesNumericCharacterReferencesInContent() {
+        val input =
+            """
+            |<html><head>
+            |  <meta property="og:description" content="&#34;You can always buy more tokens, not more time.&#34;">
+            |  <meta property="og:title" content="&#x22;hex quotes&#x22;">
+            |</head></html>
+            """.trimMargin()
+
+        val metaTags = MetaTagsParser.parse(input).toList()
+        assertEquals(2, metaTags.size)
+        assertEquals(
+            "\"You can always buy more tokens, not more time.\"",
+            metaTags[0].attr("content"),
+        )
+        assertEquals("\"hex quotes\"", metaTags[1].attr("content"))
+    }
+}