From 8a9cb8b10a7e093450c18ef3266c2594b9c2150b Mon Sep 17 00:00:00 2001
From: TBX3D <88289044+TBX3D@users.noreply.github.com>
Date: Wed, 8 Jul 2026 13:20:59 -0700
Subject: [PATCH] fix(scan): decode html entities in probe title
the probe title field is documented as an httpx-style page title, but
extractTitle returned the raw regex capture, so a title like
"Tom & Jerry" was reported verbatim instead of "Tom & Jerry".
run it through html.UnescapeString before trimming so the reported
title matches the rendered page.
---
internal/scan/probe.go | 6 ++++--
internal/scan/probe_test.go | 1 +
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/internal/scan/probe.go b/internal/scan/probe.go
index 827fd425..3c145b54 100644
--- a/internal/scan/probe.go
+++ b/internal/scan/probe.go
@@ -15,6 +15,7 @@ package scan
import (
"context"
"fmt"
+ "html"
"io"
"net/http"
"regexp"
@@ -133,13 +134,14 @@ func Probe(targetURL string, timeout time.Duration, logdir string) (*ProbeResult
}
// extractTitle returns the trimmed text of the first in body, or "" when
-// there isn't one.
+// there isn't one. html entities are decoded so the title matches the rendered
+// page rather than carrying raw "&"-style markup.
func extractTitle(body []byte) string {
m := titleRe.FindSubmatch(body)
if len(m) < 2 {
return ""
}
- return strings.TrimSpace(string(m[1]))
+ return strings.TrimSpace(html.UnescapeString(string(m[1])))
}
// ResultType identifies probe results for the result registry.
diff --git a/internal/scan/probe_test.go b/internal/scan/probe_test.go
index 246e8db8..231795ed 100644
--- a/internal/scan/probe_test.go
+++ b/internal/scan/probe_test.go
@@ -108,6 +108,7 @@ func TestProbe_ExtractTitle(t *testing.T) {
{"trimmed", "<title> spaced ", "spaced"},
{"attrs", `attr`, "attr"},
{"multiline", "line one\nline two", "line one\nline two"},
+ {"entities", "Tom & Jerry – Home", "Tom & Jerry – Home"},
{"none", "no title", ""},
}
for _, tt := range tests {