From df5fd8d0dbde248b7ff4c834f928d24bb2a5b478 Mon Sep 17 00:00:00 2001
From: Tom Moor <tom@getoutline.com>
Date: Wed, 26 Nov 2025 12:18:47 +0100
Subject: [PATCH] fix: Add missing escape on head tags (#10734)

---
 server/routes/app.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/server/routes/app.ts b/server/routes/app.ts
index 6825f7cdbe..a25417563c 100644
--- a/server/routes/app.ts
+++ b/server/routes/app.ts
@@ -113,18 +113,18 @@ export const renderApp = async (
 
   let headTags = `
     <meta name="robots" content="${allowIndexing ? "index, follow" : "noindex, nofollow"}" />
-    <link rel="canonical" href="${canonical}" />
+    <link rel="canonical" href="${escape(canonical)}" />
     <link
       rel="shortcut icon"
       type="image/png"
-      href="${shortcutIcon}"
+      href="${escape(shortcutIcon)}"
       sizes="32x32"
     />
     `;
 
   if (options.isShare) {
     headTags += `
-    <link rel="sitemap" type="application/xml" href="/api/shares.sitemap?id=${options.rootShareId || shareId}">
+    <link rel="sitemap" type="application/xml" href="/api/shares.sitemap?id=${escape(options.rootShareId || shareId)}">
     `;
   } else {
     headTags += prefetchTags;