Merge remote-tracking branch 'troll/MAGETWO-48511' into troll-bugs

Author: vzabaznov

app/code/Magento/Catalog/view/frontend/templates/product/view/opengraph/general.phtml

@@ -10,10 +10,10 @@
 ?>
 
 <meta property="og:type" content="og:product" />
-<meta property="og:title" content="<?php /* @escapeNotVerified */ echo $block->stripTags($block->getProduct()->getName()); ?>" />
-<meta property="og:image" content="<?php /* @escapeNotVerified */ echo $block->stripTags($block->getImage($block->getProduct(), 'product_base_image')->getImageUrl()); ?>" />
-<meta property="og:description" content="<?php /* @escapeNotVerified */ echo $block->stripTags($block->getProduct()->getShortDescription()); ?>" />
-<meta property="og:url" content="<?php /* @escapeNotVerified */ echo $block->stripTags($block->getProduct()->getProductUrl()); ?>" />
+<meta property="og:title" content="<?php echo $block->escapeHtml($block->getProduct()->getName()); ?>" />
+<meta property="og:image" content="<?php echo $block->escapeHtml($block->getImage($block->getProduct(), 'product_base_image')->getImageUrl()); ?>" />
+<meta property="og:description" content="<?php echo $block->escapeHtml($block->getProduct()->getShortDescription()); ?>" />
+<meta property="og:url" content="<?php echo $block->escapeHtml($block->getProduct()->getProductUrl()); ?>" />
 <?php if ($priceAmount = $block->getProduct()->getFinalPrice()):?>
     <meta property="product:price:amount" content="<?php /* @escapeNotVerified */ echo $priceAmount; ?>"/>
     <?php echo $block->getChildHtml('meta.currency'); ?>

lib/internal/Magento/Framework/View/Page/Config.php

@@ -216,7 +216,7 @@ public function getTitle()
     public function setMetadata($name, $content)
     {
         $this->build();
-        $this->metadata[$name] = $content;
+        $this->metadata[$name] = htmlentities($content);
     }
 
     /**

lib/internal/Magento/Framework/View/Test/Unit/Page/ConfigTest.php

@@ -133,8 +133,10 @@ public function testMetadata()
             'keywords' => null,
             'robots' => null,
             'name' => 'test_value',
+            'html_encoded' => '<title><span class="test">Test</span></title>',
         ];
         $this->model->setMetadata('name', 'test_value');
+        $this->model->setMetadata('html_encoded', '<title><span class="test">Test</span></title>');
         $this->assertEquals($expectedMetadata, $this->model->getMetadata());
     }