[BUG] Special characters in page title

[jrief]

Description

If a page title contains special characters, such as &, then this character is rendered as HTML-entity, for instance &.
In browser tabs this does not look right.

Steps to reproduce

• Create a page template where the page title is used. This usually is done by adding

…
<meta>
  {% page_attribute "page_title" as page_title %}
  <title>{{ page_title}}</title>
  …
</meta>
…

• Create or edit a page and use A & B as the page title.
• Load the page.

The browser tab shows A & B.

Expected behaviour

The browser tab should show A & B as page title.

Do you want to help fix this issue?

By patching the templatetag cms.templatetags.cms_tags.PageAttribute and not escaping the value, this can be fixed easily. However, I don't know what security implications this fix may have.

I would exempt escaping the string, whenever the name is page_title, just as we do it with values of type datetime.

Any objections to this?

• Yes, I want to help fix this issue and I will join #workgroup-pr-review on Slack to confirm with the community that a PR is welcome.
• No, I only want to report the issue.

[fsbraun]

@jrief Wouldn't it suffice to add safe?

<meta>
  {% page_attribute "page_title" as page_title %}
  <title>{{ page_title|safe }}</title>
  …
</meta>

Obviously, this would open up a vulnerability to scripting attacks. Maybe a custom filter that removes any tags but keeps symbols is the right way to go? (I am thinking of an escape like filter that keeps the ampersand and quote symbols. Not sure, though, which malicious things you could do with that.)

[fsbraun]

Another thought: <title>{{ page_title|striptags }}</title>?

[jrief]

Unfortunately both of them do not work.

Problem is, that the string is already escaped before creating the rendering context.
This could be circumvented by unescaping that string again. However, Django does not provide any template filter for this.

[fsbraun]

As a quick fix (use it as ...|unescape|safe):

def unescape(value): 
    """Unescapes ampersands"""
    return str(value).replace("&","&")

Still, I would expect page_attribute to deliver unescaped strings, which Django would autoescape if no safe filter is added. I'll have a look at the code...

[jrief]

I found a solution for that problem. It could be solved by applying this patch without sacrificing the security.

[fsbraun]

An alternative work-around is to use

<meta>
  <title>{{ request.current_page.get_paget_title|striptags }}</title>
  …
</meta>

[jrief]

<title>{{ request.current_page.get_page_title|striptags }}</title> is quite a lot of inderiction for an object for which we already have a canonical handle.

Shouldn't we disallow HTML tags in the title-field in the clean()-method before saving rather then on rendering?