vejja
commented
3 months ago Hi @robert-gruner
- It was not a conscious decision to keep
decodeEntities: true. It is the default for Cheerio and we did not change that. - I don't know if there would be any security implications of switching to
decodeEntities: false, but if there were it would definitely not be a CSP issue.
I read that thread about this issue: https://github.com/cheeriojs/cheerio/issues/1198.
Long story short, it looks like decodeEntities: false would be the right setup.
So I believe that we should change the option.
If you want to submit a PR feel free to do so. It would be great if you can include a test case so that we can check that it doesn't break existing sites. Something along the lines of the example in the discussion I was mentioning would be perfect :
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Document</title>
</head>
<body>
<br />
<pre>
// 哈哈哈
// swift generic
var a5 = MemoryLayout<UInt>.size
</pre>
</body>
</html>You can also include some German umlauts to verify it addresses your issues
robert-gruner
Baroshem
Hi everybody,
first of all big thanks for this high quality Nuxt module! We have integrated it successfully into a project where we build a news website.
Problem
Our SEO team has informed us, that since we enabled some Security features (CSP), our server side generated HTML contains altered encoding of certain special characters (e.g. German Umlauts like ä,ö,ü). So we have a difference in SSR HTML and the one which is in the browser.
I debugged a bit and found out that this module uses Cheerio HTML Parsing under the hood. The "problematic" part is https://github.com/Baroshem/nuxt-security/blob/2172055bd282e9b1b19fa033cbecffdd5d66a996/src/runtime/nitro/plugins/02a-preprocessHtml.ts#L22
If we change these options to include
decodeEntities: falsewe get the previous behaviour back.Proposition
I understand that it might be a good idea to use the default settings and not change it for all the users. But we would like to include an option somehow to toggle/expose this setting.
Questions
decodeEntities: true? Was it a conscious decision?If you need some more info let me know. I could also try to implement the change on my own if you give me some expecation about the config/API changes.
All the best, Robert ✌️