diff --git a/framework/core/js/src/common/Application.tsx b/framework/core/js/src/common/Application.tsx index 5db7fa84ee..8d0140fde5 100644 --- a/framework/core/js/src/common/Application.tsx +++ b/framework/core/js/src/common/Application.tsx @@ -410,16 +410,22 @@ export default class Application { pageNumber: 1, }; - const title = + let title = onHomepage || !this.title ? extractText(app.translator.trans('core.lib.meta_titles.without_page_title', params)) : extractText(app.translator.trans('core.lib.meta_titles.with_page_title', params)); - const tempEl = document.createElement('div'); - tempEl.innerHTML = title; - const decodedTitle = tempEl.innerText; + title = count + title; - document.title = count + decodedTitle; + // We pass the title through a DOMParser to allow HTML entities + // to be rendered correctly, while still preventing XSS attacks + // from user input by using a script-disabled environment. + // https://github.com/flarum/framework/issues/3514 + // https://github.com/flarum/framework/pull/3684 + const parser = new DOMParser(); + const safeTitle = parser.parseFromString(title, 'text/html').body.innerHTML; + + document.title = safeTitle; } protected transformRequestOptions(flarumOptions: FlarumRequestOptions): InternalFlarumRequestOptions { diff --git a/framework/core/views/frontend/app.blade.php b/framework/core/views/frontend/app.blade.php index 249aa3f995..2027af5c20 100644 --- a/framework/core/views/frontend/app.blade.php +++ b/framework/core/views/frontend/app.blade.php @@ -3,7 +3,7 @@ @if ($language) lang="{{ $language }}" @endif> - {!! $title !!} + {{ $title }} {!! $head !!}