fix: SSR時のmetaをエスケープするように (#13440)

* fix: SSR時のmetaをエスケープするように

* エスケープ方法を変更

packages/backend/package.json

@@ -118,6 +118,7 @@
 		"got": "14.1.0",
 		"happy-dom": "10.0.3",
 		"hpagent": "1.2.0",
+		"htmlescape": "^1.1.1",
 		"http-link-header": "1.1.1",
 		"ioredis": "5.3.2",
 		"ip-cidr": "3.1.0",
@@ -194,6 +195,7 @@
 		"@types/color-convert": "2.0.3",
 		"@types/content-disposition": "0.5.8",
 		"@types/fluent-ffmpeg": "2.1.24",
+		"@types/htmlescape": "^1.1.3",
 		"@types/http-link-header": "1.0.5",
 		"@types/jest": "29.5.11",
 		"@types/js-yaml": "4.0.9",

packages/backend/src/server/web/ClientServerService.ts

@@ -19,6 +19,7 @@ import fastifyView from '@fastify/view';
 import fastifyCookie from '@fastify/cookie';
 import fastifyProxy from '@fastify/http-proxy';
 import vary from 'vary';
+import htmlSafeJsonStringify from 'htmlescape';
 import type { Config } from '@/config.js';
 import { getNoteSummary } from '@/misc/get-note-summary.js';
 import { DI } from '@/di-symbols.js';
@@ -34,7 +35,6 @@ import { ClipEntityService } from '@/core/entities/ClipEntityService.js';
 import { ChannelEntityService } from '@/core/entities/ChannelEntityService.js';
 import type { ChannelsRepository, ClipsRepository, FlashsRepository, GalleryPostsRepository, MiMeta, NotesRepository, PagesRepository, ReversiGamesRepository, UserProfilesRepository, UsersRepository } from '@/models/_.js';
 import type Logger from '@/logger.js';
-import { deepClone } from '@/misc/clone.js';
 import { handleRequestRedirectToOmitSearch } from '@/misc/fastify-hook-handlers.js';
 import { bindThis } from '@/decorators.js';
 import { FlashEntityService } from '@/core/entities/FlashEntityService.js';
@@ -185,7 +185,7 @@ export class ClientServerService {
 			infoImageUrl: meta.infoImageUrl ?? 'https://xn--931a.moe/assets/info.jpg',
 			notFoundImageUrl: meta.notFoundImageUrl ?? 'https://xn--931a.moe/assets/not-found.jpg',
 			instanceUrl: this.config.url,
-			metaJson: JSON.stringify(await this.metaEntityService.packDetailed(meta)),
+			metaJson: htmlSafeJsonStringify(await this.metaEntityService.packDetailed(meta)),
 			now: Date.now(),
 		};
 	}

pnpm-lock.yaml

@@ -227,6 +227,9 @@ importers:
       hpagent:
         specifier: 1.2.0
         version: 1.2.0
+      htmlescape:
+        specifier: ^1.1.1
+        version: 1.1.1
       http-link-header:
         specifier: 1.1.1
         version: 1.1.1
@@ -538,6 +541,9 @@ importers:
       '@types/fluent-ffmpeg':
         specifier: 2.1.24
         version: 2.1.24
+      '@types/htmlescape':
+        specifier: ^1.1.3
+        version: 1.1.3
       '@types/http-link-header':
         specifier: 1.0.5
         version: 1.0.5
@@ -7405,6 +7411,10 @@ packages:
       '@types/unist': 3.0.2
     dev: true
 
+  /@types/htmlescape@1.1.3:
+    resolution: {integrity: sha512-tuC81YJXGUe0q8WRtBNW+uyx79rkkzWK651ALIXXYq5/u/IxjX4iHneGF2uUqzsNp+F+9J2mFZOv9jiLTtIq0w==}
+    dev: true
+
   /@types/http-cache-semantics@4.0.4:
     resolution: {integrity: sha512-1m0bIFVc7eJWyve9S0RnuRgcQqF/Xd5QsUZAZeQFr1Q3/p9JWoQQEqmVy+DPTNpGXwhgIetAoYF8JSc33q29QA==}
 
@@ -12456,6 +12466,11 @@ packages:
     engines: {node: '>=8'}
     dev: true
 
+  /htmlescape@1.1.1:
+    resolution: {integrity: sha512-eVcrzgbR4tim7c7soKQKtxa/kQM4TzjnlU83rcZ9bHU6t31ehfV7SktN6McWgwPWg+JYMA/O3qpGxBvFq1z2Jg==}
+    engines: {node: '>=0.10'}
+    dev: false
+
   /htmlparser2@8.0.1:
     resolution: {integrity: sha512-4lVbmc1diZC7GUJQtRQ5yBAeUCL1exyMwmForWkRLnwyzWBFxN633SALPMGYaWZvKe9j1pRZJpauvmxENSp/EA==}
     dependencies: