OrchardCMS / OrchardCore

Orchard Core is an open-source modular and multi-tenant application framework built with ASP.NET Core, and a content management system (CMS) built on top of that framework.
https://orchardcore.net
BSD 3-Clause "New" or "Revised" License
7.41k stars 2.39k forks source link

HTML encoding in asset_url liquid tag url #11541

Open Skrypt opened 2 years ago

Skrypt commented 2 years ago

If you look at the source code of that page in the meta tag for og:image you will see that the url is returning & instead of & between url params for resizing the image.

https://www.agriextra.ca/equipement-agricole-neuf/4r6bv974x5aq0rjanafm8eej41

https://www.agriextra.ca/media/mediafields/AccessoryEquipment/4r6bv974x5aq0rjanafm8eej41/946b4e4d5eb21b703a7140e4adcd02d6.jpg?width=1200&height=630&rmode=crop&token=Ek%2FibssTWLpatLl66WMadadBvXKN0Z3XJyB7NfeeWmw%3D

The issue is that the images never gets resized then.

jtkech commented 2 years ago

Normally the browser is able if needed to html decode and then url encode the path, but looks like that this is not the case for the Content attribute, so here this is a scenario where the path would have to be already url encoded.

But there are so many scenarios, maybe we could create an url_encode and/or maybe better an uri_encode liquid filter, aspnetcore now have cool helpers to escape/unescape a full uri by detecting and taking care of each uri component (i.e. path not encoded as a query string), we already use them with our ToUriComponents() string extension, so maybe worth to create some url/uri dedicated Liquid filter(s).

For now, maybe a workaround here is to pipe with the raw filter to not html encode it, but then normally we would still have to url encode it (but would need a new filter), but not needed if you don't have special chars.

Skrypt commented 2 years ago

Consistency is the key here of why I opened this issue.

This return a non html encoded string

@(Orchard.AssetUrl((string)Model.ContentItem.Content.ContenTypeName.ImageField.Paths[0], 1200, 630, ResizeMode.Crop))

This returns an html encoded string.

{{ Model.ContentItem.Content.ContenTypeName.ImageField.Paths[0] | asset_url | resize_url: width:1200, height:630, mode: 'crop' }}
Skrypt commented 2 years ago

We are missing a UriContentValue along with the HtmlContentValue and StringValue for Liquid.

jtkech commented 2 years ago

For info i.e. this comment https://github.com/OrchardCMS/OrchardCore/pull/11370#issue-1167430474

sebastienros commented 2 years ago

Are you generating the og:image tag by yourself in the html template, and not using the SEO feature?

{{ blah }} will be html encoded unless we decide that resize_url should return a raw string. I don't thing it should because it might be used in contexts where encoding matters (json?).

I'd say use | raw here.

Skrypt commented 2 years ago

Yes | raw fixes the issue and yes I'm rendering the tag by myself on a custom MVC controller/view Razor template.