Bug: when a product meta description is empty, the system set the product description as meta description for the frontend product page but does not strip HTML tags which can break the page (and my fix)

[dmitrii-fediuk]

https://mage2.pro/t/161

[orlov0562]

Hi there, keep in mind that in present time, the code allows to save scripts through meta fields (XSS vulnerability). To prevent this you should strip tags not only in case when description is empty (solution that Dmitry suggest). The steps to reproduce you can find at the next forum: https://community.magento.com/t5/Technical-Issues/XSS-in-Magento-2-CE/m-p/22521

[dmitrii-fediuk]

https://community.magento.com/t5/Technical-Issues/Adding-Products-Meta-Desc-Bug/m-p/25035

[kandy]

Doplicate #1514