1
56%
master: 56%

Ran 22 Jul 2026 06:11PM UTC

Files 176

Run time 10s

Badge

Embed ▾

Committed 22 Jul 2026 06:07PM UTC coverage: 58.398% (+0.08%) from 58.314%

Job # 29945298968.1

Build Type

push

github

Committed by

web-flow

Commit Message

fix: escape image and url metadata values in replaceHelmetMetadata (#1327)

* fix: escape image and url metadata values in replaceHelmetMetadata

replaceHelmetMetadata escaped title and description before interpolating
them into `<meta content="...">` attributes, but injected the `image` and
`url` values raw and then reparsed the result as html. a value such as
`https://x"><script>...</script>` therefore broke out of the attribute
and became live markup in `<head>` — a stored-xss / defacement vector for
any consumer that renders attacker-controlled image/url metadata (e.g. the
places social/opengraph endpoint).

escape `image` and `url` with the same helper used for the other fields so
every metadata branch is contextually encoded before html insertion.

* fix: escape metadata keys in replaceHelmetMetadata

the default branch interpolated the metadata key raw into the `name` /
`property` attribute while only escaping the value, so a caller-supplied
key such as `x"><script>...</script><meta name="y` could break out of the
attribute even when the value was safe.

escape the key with the same helper used for the value in both the `name`
and `og:`/`property` branches, and add regression tests for each.

Coverage Stats

559 of 1195 branches covered (46.78%)

Branch coverage included in aggregate %.

2532 of 4098 relevant lines covered (61.79%)

5.9 hits per line

decentraland / decentraland-gatsby / 29945298968 / 1
56%
master: 56%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 29945298968.1

decentraland / decentraland-gatsby / 29945298968 / 1 56% master: 56%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 29945298968.1

decentraland / decentraland-gatsby / 29945298968 / 1
56%
master: 56%

README BADGES
x