Meta tags don't filter out HTML tags

... oh dear.

Need to fix this and write tests for it.

Here is a patch that fixes it. I took the approach from core:

core/modules/user/user.module:920:  $message['subject'] .= PlainTextOutput::renderFromHtml($token_service->replace($mail_config->get($key . '.subject'), $variables, $token_options));

Committed. Thanks!

Just updated from beta3 to dev through drush up metatag-1.x-dev (which worked I got several of the fixes, such as issue #2642430) and rebuilt cache but I'm still seing html tags when using [node-summary] in the description meta:

Value of the summary:
This <strong>is a test</strong>
Meta description rendering:
<meta name="description" content="This &lt;strong&gt;is a test&lt;/strong&gt;" />
<meta property="og:description" content="This &lt;strong&gt;is a test&lt;/strong&gt;" />

Did I miss a step?

Ok, lets add some tests.

What's weird is that the API docs say that the HTML tags are supposed to be stripped from the content, so it should be working correctly. Definitely need to dig into this a little bit for the next beta release.

Bumping this to beta5 so that beta4 can be released sooner.

Patch from #6 will break metatags with tokens for node's image field - it will just strip out <img> tag. So needs at least check like

if ($tag->image()) {
  $processed_value = $this->tokenService->tokenReplace($tag->value(), $token_replacements);
}
else {
  $processed_value = PlainTextOutput::renderFromHtml($this->tokenService->tokenReplace($tag->value(), $token_replacements));
}

@sushichris @DamienMcKenna @juliencarnot - I've been working on the issue of HTML tags still being rendered and think I've found the reason. The PlainTextOutput::renderFromHtml function correctly strips HTML tags, however the value in $token_replacements seems to already be sanitized with HTML tags converted to HTML special characters. Therefore <, > etc remain in the output.
Adding htmlspecialchars_decode to the function resolves this and means all HTML tags are correctly removed. Suggested patch attached

Would someone mind trying to write a test for this? Thanks.

@sushichris: Can you please provide the exact HTML tag that is output on the page? No parts of the "*/ /*-->*/ Product Addons SEO" string appear in the HTML chunk you provided, are you sure you're looking at the right HTML?

@DamienMcKenna Attached is an updated version of my patch with tests. The tests work on three values in metatags -- one without any HTML; one with raw html; and one with escaped HTML. To pass all HTML including escaped should be removed.

Updated patch which includes code from #15 to fix issue with images @YurikK_

@mikeyk:

I applied meta_tags_don_t_filter-2631408-22.patch from comment #22 on a fresh 8.x-1.x clone, uninstalled and reinstalled metatag and opengraph&twitter submodules to rule out problems with previous config and used drush cr to rebuild cache.

I get a fatal error on the homepage:
Fatal error: Unsupported operand types in /var/www/html/modules/metatag/src/MetatagToken.php on line 99

On the extensions page, there are some notices and warnings:

    Warning: Missing argument 3 for Drupal\metatag\MetatagToken::tokenReplace(), called in /var/www/html/modules/metatag/src/MetatagManager.php on line 303 and defined in Drupal\metatag\MetatagToken->tokenReplace() (line 52 of modules/metatag/src/MetatagToken.php).

    Drupal\metatag\MetatagToken->tokenReplace('[node:title] | [site:name]', Array)
    Drupal\metatag\MetatagManager->generateElements(Array, Object)
    metatag_get_tags_from_route()
    metatag_page_attachments(Array)
    Drupal\Core\Render\MainContent\HtmlRenderer->invokePageAttachmentHooks(Array)
    Drupal\Core\Render\MainContent\HtmlRenderer->prepare(Array, Object, Object)
    Drupal\Core\Render\MainContent\HtmlRenderer->renderResponse(Array, Object, Object)
    Drupal\Core\EventSubscriber\MainContentViewSubscriber->onViewRenderArray(Object, 'kernel.view', Object)
    Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch('kernel.view', Object)
    Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1)
    Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1)
    Drupal\page_cache\StackMiddleware\PageCache->pass(Object, 1, 1)
    Drupal\page_cache\StackMiddleware\PageCache->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1)
    Stack\StackedHttpKernel->handle(Object, 1, 1)
    Drupal\Core\DrupalKernel->handle(Object)

    Notice: Undefined variable: settings in Drupal\metatag\MetatagToken->tokenReplace() (line 54 of modules/metatag/src/MetatagToken.php).

    Drupal\metatag\MetatagToken->tokenReplace('[node:title] | [site:name]', Array)
    Drupal\metatag\MetatagManager->generateElements(Array, Object)
    metatag_get_tags_from_route()
    metatag_page_attachments(Array)
    Drupal\Core\Render\MainContent\HtmlRenderer->invokePageAttachmentHooks(Array)
    Drupal\Core\Render\MainContent\HtmlRenderer->prepare(Array, Object, Object)
    Drupal\Core\Render\MainContent\HtmlRenderer->renderResponse(Array, Object, Object)
    Drupal\Core\EventSubscriber\MainContentViewSubscriber->onViewRenderArray(Object, 'kernel.view', Object)
    Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch('kernel.view', Object)
    Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1)
    Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1)
    Drupal\page_cache\StackMiddleware\PageCache->pass(Object, 1, 1)
    Drupal\page_cache\StackMiddleware\PageCache->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1)
    Stack\StackedHttpKernel->handle(Object, 1, 1)
    Drupal\Core\DrupalKernel->handle(Object)

    Warning: Missing argument 3 for Drupal\metatag\MetatagToken::tokenReplace(), called in /var/www/html/modules/metatag/src/MetatagManager.php on line 303 and defined in Drupal\metatag\MetatagToken->tokenReplace() (line 52 of modules/metatag/src/MetatagToken.php).

    Drupal\metatag\MetatagToken->tokenReplace('[node:title] | [site:name]', Array)
    Drupal\metatag\MetatagManager->generateElements(Array, Object)
    metatag_get_tags_from_route()
    metatag_page_attachments(Array)
    Drupal\Core\Render\MainContent\HtmlRenderer->invokePageAttachmentHooks(Array)
    Drupal\Core\Render\MainContent\HtmlRenderer->prepare(Array, Object, Object)
    Drupal\Core\Render\MainContent\HtmlRenderer->renderResponse(Array, Object, Object)
    Drupal\Core\EventSubscriber\MainContentViewSubscriber->onViewRenderArray(Object, 'kernel.view', Object)
    Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch('kernel.view', Object)
    Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1)
    Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1)
    Drupal\page_cache\StackMiddleware\PageCache->pass(Object, 1, 1)
    Drupal\page_cache\StackMiddleware\PageCache->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1)
    Stack\StackedHttpKernel->handle(Object, 1, 1)
    Drupal\Core\DrupalKernel->handle(Object)

    Notice: Undefined variable: settings in Drupal\metatag\MetatagToken->tokenReplace() (line 54 of modules/metatag/src/MetatagToken.php).

    Drupal\metatag\MetatagToken->tokenReplace('[node:title] | [site:name]', Array)
    Drupal\metatag\MetatagManager->generateElements(Array, Object)
    metatag_get_tags_from_route()
    metatag_page_attachments(Array)
    Drupal\Core\Render\MainContent\HtmlRenderer->invokePageAttachmentHooks(Array)
    Drupal\Core\Render\MainContent\HtmlRenderer->prepare(Array, Object, Object)
    Drupal\Core\Render\MainContent\HtmlRenderer->renderResponse(Array, Object, Object)
    Drupal\Core\EventSubscriber\MainContentViewSubscriber->onViewRenderArray(Object, 'kernel.view', Object)
    Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch('kernel.view', Object)
    Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1)
    Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1)
    Drupal\page_cache\StackMiddleware\PageCache->pass(Object, 1, 1)
    Drupal\page_cache\StackMiddleware\PageCache->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1)
    Stack\StackedHttpKernel->handle(Object, 1, 1)
    Drupal\Core\DrupalKernel->handle(Object)

    Warning: Missing argument 3 for Drupal\metatag\MetatagToken::tokenReplace(), called in /var/www/html/modules/metatag/src/MetatagManager.php on line 303 and defined in Drupal\metatag\MetatagToken->tokenReplace() (line 52 of modules/metatag/src/MetatagToken.php).

    Drupal\metatag\MetatagToken->tokenReplace('[node:title] | [site:name]', Array)
    Drupal\metatag\MetatagManager->generateElements(Array, Object)
    metatag_get_tags_from_route()
    metatag_page_attachments(Array)
    Drupal\Core\Render\MainContent\HtmlRenderer->invokePageAttachmentHooks(Array)
    Drupal\Core\Render\MainContent\HtmlRenderer->prepare(Array, Object, Object)
    Drupal\Core\Render\MainContent\HtmlRenderer->renderResponse(Array, Object, Object)
    Drupal\Core\EventSubscriber\MainContentViewSubscriber->onViewRenderArray(Object, 'kernel.view', Object)
    Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch('kernel.view', Object)
    Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1)
    Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1)
    Drupal\page_cache\StackMiddleware\PageCache->pass(Object, 1, 1)
    Drupal\page_cache\StackMiddleware\PageCache->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1)
    Stack\StackedHttpKernel->handle(Object, 1, 1)
    Drupal\Core\DrupalKernel->handle(Object)

    Notice: Undefined variable: settings in Drupal\metatag\MetatagToken->tokenReplace() (line 54 of modules/metatag/src/MetatagToken.php).

    Drupal\metatag\MetatagToken->tokenReplace('[node:title] | [site:name]', Array)
    Drupal\metatag\MetatagManager->generateElements(Array, Object)
    metatag_get_tags_from_route()
    metatag_page_attachments(Array)
    Drupal\Core\Render\MainContent\HtmlRenderer->invokePageAttachmentHooks(Array)
    Drupal\Core\Render\MainContent\HtmlRenderer->prepare(Array, Object, Object)
    Drupal\Core\Render\MainContent\HtmlRenderer->renderResponse(Array, Object, Object)
    Drupal\Core\EventSubscriber\MainContentViewSubscriber->onViewRenderArray(Object, 'kernel.view', Object)
    Drupal\Component\EventDispatcher\ContainerAwareEventDispatcher->dispatch('kernel.view', Object)
    Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object, 1)
    Symfony\Component\HttpKernel\HttpKernel->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\Session->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\KernelPreHandle->handle(Object, 1, 1)
    Drupal\page_cache\StackMiddleware\PageCache->pass(Object, 1, 1)
    Drupal\page_cache\StackMiddleware\PageCache->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\ReverseProxyMiddleware->handle(Object, 1, 1)
    Drupal\Core\StackMiddleware\NegotiationMiddleware->handle(Object, 1, 1)
    Stack\StackedHttpKernel->handle(Object, 1, 1)
    Drupal\Core\DrupalKernel->handle(Object)

@juliencarnot Thanks for the feedback - Here is an updated version with the the langcode array added. This should fix the errors you got from patch #22.

@mikeyk: Thanks, the patch fixes the errors and now I get the relative path of the first image stored in my field for the node for twitter_cards_image or all the relative paths separated by commas for og_image (which is not compliant with opengraph apparently, but it might be an issue pertaining to the og submodule). However, it seems that Twitter card validator needs the absolute path. I tried using [site:url][node:field_image] or even putting the website's URL in front of [node:field_image] , to no avail.

Also, a bonus question: shouldn't [node:field_image:1] give only the URL of the second image in the field? It could allow to pick the main image for open-graph.

@juliencarnot @DamienMcKenna I've done some more work on this and fixed a couple more things. The issue that @juliencarnot raised with relative paths is an interesting one - I tested this module with #24 patch on a Drupal 8.0.3 installation and the paths produced were absolute, however once I upgraded to 8.0.4 or 8.0.5 the paths became relative. Drupal 8.0.4 was a security release so this must have been changed for a good reason, but it explains why it's only recently become an issue.
The updated patch should convert a relative path to an absolute one based on the global $base_url. Let me know how you go with this one!

This patch also fixes two related issues I've found with OgImageSecureUrl (not sure if this is going beyond the scope of this issue - I can open a new one if so. The code to fix this is in the same block so I thought to include it in this)
1. Paths for OgImageSecureUrl containing http:// should be converted to https:// but weren't
2. OgImageSecureUrl's attributes had its image property set to False, and so would not be processed as the regular OgImage tag. This has been changed to True.

@juliencarnot - As for your bonus question, as far as I know the [node:field_image:1] token isn't provided in core or the Token module - but is in the Field Tokens module. If you install that you should be able to do what you want by using the token [node:field_image-formatted:1] (note the -formatted).

Tested and approved, the absolute URL is shown! Not using OgImageSecureUrl as all my site is in https, so I'll let somebody else review that part! Thanks for the patches and for your advice regarding Field Tokens, I knew I was missing something!

Any idea on when a new release can happen? #22 fixes an issue I was having with image urls. Applied the patch and all looks good.

This just tidies up the code & comments a little, no actual logic changes.

Oh wait, there was one logic change - I removed the special handling for the og:image:secure_url tag because it didn't belong there, there needs to be a new 'secure' attribute that is tag-agnostic.

The secure URLs thing will be handled in #2684479: Support for 'secure' URLs in meta tags (D7 feature port).

Committed. Thanks all!

Hey there,

first of all: great work guys, the metatag module is really a must-have and now even available for D8 :)

We use it on a Drupal 8 blog which lives in a subdirectory, e.g. www.site.com/blog/ and the extracted image URLs are wrong in that case.

Currently: www.site.com/blog/blog/sites/default/files/2016-03/team.jpg
Correct would be: www.site.com/blog/sites/default/files/2016-03/team.jpg

The problem seems to be the use of $base_url because both the base url AND the image path contain the subdirectory (/blog).
I suggest to use $base_root in this case since the relative image path starts with a "/" and thus references www.site.com/ and not www.site.com/blog/.

Patch is attached.

(Is it OK to re-open this issue or should I have created a new one?)

@kplanz: Oh bummer, thanks for reporting it. Please open a new issue for this issue? Thanks.

Done: #2689543: Wrong image URL when Drupal lives in subdirectory