🐛 Fixed stored XSS in structured data via unescaped tag names

[swithek]

Tag names, post keywords, and the site title were written into the inline JSON-LD <script type="application/ld+json"> block via JSON.stringify, which doesn't escape </script>. An Editor-controlled tag name like foo</script><script>alert(document.domain)</script> broke out of the script element and executed arbitrary JS for any anonymous visitor on tag and post pages.

Fix

Escape the three affected fields with escapeExpression in getTagSchema, getPostSchema, and getHomeSchema. This is consistent with every other text field in the file (headline, description, author/publisher name), which were already escaped.

Testing

Added regression tests asserting a </script> payload is HTML-escaped in tag, post-keywords, and home schema output.
Updated the existing ghost_head snapshot that was silently capturing the previously-unescaped post keywords.

• I've read and followed the Contributor Guide
• I've explained my change
• I've written an automated test to prove my change works

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6008203e-bd62-4ff1-876c-c483c2173f19

📥 Commits

Reviewing files that changed from the base of the PR and between 6702db4 and 493fdab.

⛔ Files ignored due to path filters (1)

• ghost/core/test/unit/frontend/helpers/__snapshots__/ghost-head.test.js.snap is excluded by !**/*.snap

📒 Files selected for processing (2)

• ghost/core/core/frontend/meta/schema.js
• ghost/core/test/unit/frontend/meta/schema.test.js

✅ Files skipped from review due to trivial changes (1)

• ghost/core/core/frontend/meta/schema.js

🚧 Files skipped from review as they are similar to previous changes (1)

• ghost/core/test/unit/frontend/meta/schema.test.js

---

Walkthrough

escapeExpression is applied to three user-controlled schema fields in schema.js: the joined metaData.keywords value in getPostSchema, metaData.site.title in getHomeSchema, and data.tag.name in getTagSchema. New unit tests in schema.test.js verify that </script> payloads are HTML-escaped in the generated JSON-LD name and keywords fields.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the stored XSS fix in structured data escaping, which is the main change in this PR.
Description check	✅ Passed	The description is directly related to the changeset and correctly explains the escaping fix, tests, and affected fields.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[9larsons]

@swithek Thanks for this! While correct, this is still playing a bit of whack-a-mole and sets us up for adding new fields that aren't properly escaped. I've reworked this in #29013.