Index: src/views/shell.ejs
===================================================================
--- src/views/shell.ejs (revision 34875673eb7989a5ab1986334ece32f689bab211)
+++ src/views/shell.ejs (revision 48027f29830b79c87770fe10fc1f9970d91fcc63)
@@ -1,8 +1,13 @@
<%
// ── Helpers used inside this template ─────────────────────────────
+// Escape for double-quoted HTML attributes. IMPORTANT: emit this with the RAW EJS output
+// tag, never the escaping one — escaping it a second time turned og:title "Jason's" into the
+// double-escaped "Jason's", and naive OG scrapers (Signal/WhatsApp) show that literally.
+// We deliberately do NOT escape the apostrophe: it is safe inside a double-quoted attribute and
+// a literal apostrophe is what link-preview scrapers expect.
function _e(s) {
return String(s == null ? '' : s)
.replace(/&/g, '&').replace(//g, '>')
- .replace(/"/g, '"').replace(/'/g, ''');
+ .replace(/"/g, '"');
}
@@ -104,5 +109,5 @@
}
%>
-
+
@@ -111,29 +116,29 @@
<%= _finalTitle %>
-
-
+
+
-<% if (safeSite.author) { %><% } %>
-<% if (_canonical) { %><% } %>
+<% if (safeSite.author) { %><% } %>
+<% if (_canonical) { %><% } %>
-<% if (safeSite.google_verification) { %><% } %>
-<% if (safeSite.bing_verification) { %><% } %>
-<% if (safeSite.pinterest_verification) { %><% } %>
-<% if (safeSite.yandex_verification) { %><% } %>
+<% if (safeSite.google_verification) { %><% } %>
+<% if (safeSite.bing_verification) { %><% } %>
+<% if (safeSite.pinterest_verification) { %><% } %>
+<% if (safeSite.yandex_verification) { %><% } %>
<% if (site) { %>
-
-
+
+
<% } %>
-
+
-
-
+
+
@@ -141,11 +146,11 @@
-
-
-
-
+
+
+
+
<% if (_socialImage) { %>
-
-
+
+
<% if (_ogGenerated) { %>
@@ -154,5 +159,5 @@
<% } %>
<% } %>
-<% if (_canonical) { %><% } %>
+<% if (_canonical) { %><% } %>
<%
// Fediverse/social PLAYER card for posts with audio: instead of shipping the raw
@@ -167,6 +172,6 @@
%>
<% if (_postAudio) { %>
-
-
+
+
@@ -174,20 +179,20 @@
<% } %>
<% if (typeof post !== 'undefined' && post && post.published_at) { %>
-
-<% if (post.author_username) { %><% } %>
-<% } %>
-<% if (safeSite.facebook_app_id) { %><% } %>
+
+<% if (post.author_username) { %><% } %>
+<% } %>
+<% if (safeSite.facebook_app_id) { %><% } %>
<% if (_postAudio) { %>
-
+
<% } %>
-
-
-<% if (_socialImage) { %><% } %>
-<% if (safeSite.twitter) { %><% } %>
+
+
+<% if (_socialImage) { %><% } %>
+<% if (safeSite.twitter) { %><% } %>
<% if (_jsonLd) { %>
@@ -266,7 +271,7 @@
:root,
[data-palette] {
- --accent: <%= _e(safeAccent) %>;
- --accent-soft: color-mix(in srgb, <%= _e(safeAccent) %> 80%, white);
- --accent-tint: color-mix(in srgb, <%= _e(safeAccent) %> 12%, transparent);
+ --accent: <%- _e(safeAccent) %>;
+ --accent-soft: color-mix(in srgb, <%- _e(safeAccent) %> 80%, white);
+ --accent-tint: color-mix(in srgb, <%- _e(safeAccent) %> 12%, transparent);
}
@@ -323,5 +328,5 @@
-
+
<% if (typeof isViewer !== 'undefined' && isViewer) { %>