diff --git a/packages/content-fetch/twitter-handler.js b/packages/content-fetch/twitter-handler.js
index 99bab6661..7ae93072c 100644
--- a/packages/content-fetch/twitter-handler.js
+++ b/packages/content-fetch/twitter-handler.js
@@ -6,6 +6,7 @@
require('dotenv').config();
const axios = require('axios');
const { DateTime } = require('luxon');
+const _ = require('underscore');
const TWITTER_BEARER_TOKEN = process.env.TWITTER_BEARER_TOKEN;
const TWITTER_URL_MATCH = /twitter\.com\/(?:#!\/)?(\w+)\/status(?:es)?\/(\d+)(?:\/.*)?/
@@ -116,7 +117,8 @@ exports.twitterHandler = {
const tweetData = (await getTweetById(tweetId)).data;
const authorId = tweetData.data.author_id;
const author = tweetData.includes.users.filter(u => u.id = authorId)[0];
- const title = titleForAuthor(author)
+ // escape html entities in title
+ const title = _.escape(titleForAuthor(author))
const authorImage = author.profile_image_url.replace('_normal', '_400x400')
let text = tweetData.data.text;
@@ -157,7 +159,7 @@ exports.twitterHandler = {
-
+
${front}
diff --git a/packages/content-fetch/youtube-handler.js b/packages/content-fetch/youtube-handler.js
index cdf9bee32..e1866428a 100644
--- a/packages/content-fetch/youtube-handler.js
+++ b/packages/content-fetch/youtube-handler.js
@@ -37,6 +37,7 @@ exports.youtubeHandler = {
const oembedUrl = `https://www.youtube.com/oembed?format=json&url=` + encodeURIComponent(`https://www.youtube.com/watch?v=${videoId}`)
const oembed = (await axios.get(oembedUrl.toString())).data;
+ // escape html entities in title
const title = _.escape(oembed.title);
const ratio = oembed.width / oembed.height;
const thumbnail = oembed.thumbnail_url;