From 61239994dac4389d21299f4fb947c6d72ad2a145 Mon Sep 17 00:00:00 2001
From: fflorent <florent.git@zeteo.me>
Date: Mon, 18 Nov 2024 21:12:08 +0100
Subject: [PATCH] Escape translations and keep key for Loading

---
 app/server/lib/sendAppPage.ts | 24 ++++++++++++++----------
 static/locales/en.server.json |  2 +-
 static/locales/fr.server.json |  2 +-
 3 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/app/server/lib/sendAppPage.ts b/app/server/lib/sendAppPage.ts
index b52541918f..cd0a06c8b7 100644
--- a/app/server/lib/sendAppPage.ts
+++ b/app/server/lib/sendAppPage.ts
@@ -27,9 +27,13 @@ import jsesc from 'jsesc';
 import * as path from 'path';
 import { difference, trimEnd } from 'lodash';
 
-const translate = (req: express.Request, key: string, args?: any) => req.t(`sendAppPage.${key}`, args)?.toString();
 const { escapeExpression } = handlebars.Utils;
 
+const translateEscaped = (req: express.Request, key: string, args?: any) => {
+  const res = req.t(`sendAppPage.${key}`, args)?.toString();
+  return res ? escapeExpression(res) : res;
+};
+
 export interface ISendAppPageOptions {
   path: string;        // Ignored if .content is present (set to "" for clarity).
   content?: string;
@@ -176,7 +180,7 @@ export function makeSendAppPage({ server, staticDir, tag, testLogin, baseDomain
     ).join('\n');
     const content = fileContent
       .replace("<!-- INSERT WARNING -->", warning)
-      .replace("<!-- INSERT TITLE -->", getDocName(config) ?? translate(req, 'Loading...'))
+      .replace("<!-- INSERT TITLE -->", getDocName(config) ?? escapeExpression(translateEscaped(req, 'Loading')))
       .replace("<!-- INSERT META -->", getPageMetadataHtmlSnippet(req, config))
       .replace("<!-- INSERT TITLE SUFFIX -->", getPageTitleSuffix(server.getGristConfig()))
       .replace("<!-- INSERT BASE -->", `<base href="${staticBaseUrl}">` + tagManagerSnippet)
@@ -291,11 +295,13 @@ function getPageMetadataHtmlSnippet(req: express.Request, config: GristLoadConfi
 
   metadataElements.push('<meta property="og:type" content="website">');
   metadataElements.push('<meta name="twitter:card" content="summary_large_image">');
-  const description = maybeDoc?.options?.description ?? translate(req, 'og-description');
-  const escapedDescription = escapeExpression(description);
-  metadataElements.push(`<meta name="description" content="${escapedDescription}">`);
-  metadataElements.push(`<meta property="og:description" content="${escapedDescription}">`);
-  metadataElements.push(`<meta name="twitter:description" content="${escapedDescription}">`);
+
+  const description = maybeDoc?.options?.description ?
+    escapeExpression(maybeDoc.options.description) :
+    translateEscaped(req, 'og-description');
+  metadataElements.push(`<meta name="description" content="${description}">`);
+  metadataElements.push(`<meta property="og:description" content="${description}">`);
+  metadataElements.push(`<meta name="twitter:description" content="${description}">`);
 
   const image = escapeExpression(maybeDoc?.options?.icon ?? commonUrls.openGraphPreviewImage);
   metadataElements.push(`<meta name="thumbnail" content="${image}">`);
@@ -303,9 +309,7 @@ function getPageMetadataHtmlSnippet(req: express.Request, config: GristLoadConfi
   metadataElements.push(`<meta name="twitter:image" content="${image}">`);
 
   const maybeDocTitle = getDocName(config);
-  const title = escapeExpression(
-    maybeDocTitle ? maybeDocTitle + getPageTitleSuffix(config) : translate(req, 'og-title')
-  );
+  const title = maybeDocTitle ? maybeDocTitle + getPageTitleSuffix(config) : translateEscaped(req, 'og-title');
   // NB: We don't generate the content of the <title> tag here.
   metadataElements.push(`<meta property="og:title" content="${title}">`);
   metadataElements.push(`<meta name="twitter:title" content="${title}">`);
diff --git a/static/locales/en.server.json b/static/locales/en.server.json
index e39a55bc6f..c3bdbe6578 100644
--- a/static/locales/en.server.json
+++ b/static/locales/en.server.json
@@ -1,6 +1,6 @@
 {
   "sendAppPage": {
-    "Loading...": "Loading...",
+    "Loading": "Loading...",
     "og-description": "A modern, open source spreadsheet that goes beyond the grid",
     "og-title": "Grist, the evolution of spreadsheets"
   },
diff --git a/static/locales/fr.server.json b/static/locales/fr.server.json
index 05535d3f31..84879b4216 100644
--- a/static/locales/fr.server.json
+++ b/static/locales/fr.server.json
@@ -1,5 +1,5 @@
 {
   "sendAppPage": {
-    "Loading...": "Chargement..."
+    "Loading": "Chargement..."
   }
 }