- Affected version
- 2.3.12
My AI found something. Or I found the error in Google search console, AI the problem and fix.
AI report follows:
Affected version: 2.3.12
Summary
The WebSite/SearchAction JSON-LD in the helper_js_global template uses:
for URLs inside JSON.
The JS escaper modifies a double hyphen by inserting a backslash. This produces invalid JSON when a URL contains a double hyphen.
This affects IDN hostnames in punycode, since they contain the xn-- prefix.
Example
Board URL:
Expected JSON:
Generated JSON:
The relevant code in XF::escapeString() is:
This is valid for the JS escaper, but the resulting backslash-hyphen escape is not valid JSON.
Google Search Console consequently reports the JSON-LD as invalid.
Suggested fix
The values are inside JSON-LD, so escape('json') should be used instead of escape('js').
For example:
The same change should be made for the SearchAction urlTemplate.
The json branch of XF::escapeString() already avoids the double-hyphen transformation.
AI report follows:
Affected version: 2.3.12
Summary
The WebSite/SearchAction JSON-LD in the helper_js_global template uses:
Code:
escape('js')for URLs inside JSON.
The JS escaper modifies a double hyphen by inserting a backslash. This produces invalid JSON when a URL contains a double hyphen.
This affects IDN hostnames in punycode, since they contain the xn-- prefix.
Example
Board URL:
Code:
https://www.xn--lnforum-exa.se/Expected JSON:
Code:
"url": "https://www.xn--lnforum-exa.se/"Generated JSON:
Code:
"url": "https://www.xn-\-lnforum-exa.se/"The relevant code in XF::escapeString() is:
PHP:
$value = preg_replace('/-(?=-)/', '-\\', $value);This is valid for the JS escaper, but the resulting backslash-hyphen escape is not valid JSON.
Google Search Console consequently reports the JSON-LD as invalid.
Suggested fix
The values are inside JSON-LD, so escape('json') should be used instead of escape('js').
For example:
Code:
{{ link('canonical:index')|escape('json') }}The same change should be made for the SearchAction urlTemplate.
The json branch of XF::escapeString() already avoids the double-hyphen transformation.