I'm asked to advise on a scenario where meta tags in a 404 error page include the Open Graph og:url, which is (I'm told) being populated by React libraries.
- The full url as presented to the server is included.
- It's URL encoded.
On principle, this raises cross-site scripting vulnerability concerns.
In terms of advising on a course of action, I'm having a hard time, given the following considerations:
The og:url tag seems intended for generating page view and such social network type statistics. Putting it in an error page is pointless. However, it seems it's coming from some React libraries that may not be sufficiently tunable to easily change this behavior.
It's URL encoded, which provides a fair degree of insulation. On the other hand, this isn't in a browser address bar; it's embedded in HTML, so HTML encoding would seem more appropriate. Is there a significant exposure due to this difference?
The og:url field, from what my brief googling came up with, seems better used to point to a "canonical" URL so that page hit tallies are aggregated. Putting a raw URL which in our case can have many document paths past the top level in the og:url field seems... suboptimal, even aside from the XSS exposure.