Automattic / Automattic/jetpack

Meta Tags Partially Discloses Content on Paid Newsletters

Open
#34,343 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
1.8k
Forks
898
Avg merge
1d 18h
Merged PRs (30d)
774

Description

### Impacted plugin

Jetpack

### Quick summary

When using the paid newsletter feature, a portion of the content and an image (if available) will be used to generate meta tags for the post. This leads to a portion of the content being revealed.

### Steps to reproduce

1. Add a post for paid subscribers only
2. View the post as a non-paid subscriber and view the page source
3. Some content from the post will be auto-used to populate the meta tags in the `head`

### A clear and concise description of what you expected to happen.

I expect we wouldn't use the paid content and image (if added) by default and instead indicate that the post is for paid users.

### What actually happened

Screenshot 2023-11-28 at 11 28 30

Screenshot 2023-11-28 at 11 29 54

### Impact

Some (< 50%)

### Available workarounds?

No but the platform is still usable

### Platform (Simple and/or Atomic)

_No response_

### Logs or notes

- Related issue: #34342
- Internal reference: p1707275242069129-slack-C052XEUUBL4

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the paid-subscriber post scenario and inspect the page source for generated meta tags. Trace the Jetpack code that builds meta tags for paid newsletter posts, then verify that restricted content and images are not exposed and that the page instead indicates paid-only access.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.