fix: ssr open graph tags (#27639)

fix: SSR open graph tags

server/src/services/api.service.spec.ts

@@ -0,0 +1,36 @@
+import { ApiService, render } from 'src/services/api.service';
+
+describe(ApiService.name, () => {
+  describe('render', () => {
+    it('should correctly render open graph tags', () => {
+      const output = render('<!-- metadata:tags -->', {
+        title: 'title',
+        description: 'description',
+        imageUrl: 'https://demo.immich.app/api/assets/123',
+      });
+      expect(output).toContain('<meta property="og:title" content="title" />');
+      expect(output).toContain('<meta property="og:description" content="description" />');
+      expect(output).toContain('<meta property="og:image" content="https://demo.immich.app/api/assets/123" />');
+    });
+
+    it('should escape html tags', () => {
+      expect(
+        render('<!-- metadata:tags -->', {
+          title: "<script>console.log('hello')</script>Test",
+          description: 'description',
+        }),
+      ).toContain(
+        '<meta property="og:title" content="&lt;script&gt;console.log(&#39;hello&#39;)&lt;/script&gt;Test" />',
+      );
+    });
+
+    it('should escape quotes', () => {
+      expect(
+        render('<!-- metadata:tags -->', {
+          title: `0;url=https://example.com" http-equiv="refresh`,
+          description: 'description',
+        }),
+      ).toContain('<meta property="og:title" content="0;url=https://example.com&quot; http-equiv=&quot;refresh" />');
+    });
+  });
+});

server/src/services/api.service.ts

@@ -1,7 +1,7 @@
 import { Injectable, NotAcceptableException } from '@nestjs/common';
 import { NextFunction, Request, Response } from 'express';
+import { escape } from 'lodash';
 import { readFileSync } from 'node:fs';
-import sanitizeHtml from 'sanitize-html';
 import { ConfigRepository } from 'src/repositories/config.repository';
 import { LoggingRepository } from 'src/repositories/logging.repository';
 import { AuthService } from 'src/services/auth.service';
@@ -10,7 +10,7 @@ import { OpenGraphTags } from 'src/utils/misc';
 
 export const render = (index: string, meta: OpenGraphTags) => {
   const [title, description, imageUrl] = [meta.title, meta.description, meta.imageUrl].map((item) =>
-    item ? sanitizeHtml(item, { allowedTags: [] }) : '',
+    item ? escape(item) : '',
   );
 
   const tags = `