nitdoc: Escape links’ attributes.

Signed-off-by: Jean-Christophe Beaupré <jcbrinfo@users.noreply.github.com>

diff --git a/src/doc/doc_pages.nit b/src/doc/doc_pages.nit
index ae2dde5..0d26ad6 100644 (file)
--- a/src/doc/doc_pages.nit
+++ b/src/doc/doc_pages.nit
@@ -386,7 +386,7 @@ abstract class NitdocPage
                var source = ctx.opt_source.value
                if source == null then
                        var url = location.file.filename.simplify_path
-                       return "<a target='_blank' title='Show source' href=\"{url}\">View Source</a>"
+                       return "<a target='_blank' title='Show source' href=\"{url.html_escape}\">View Source</a>"
                end
                # THIS IS JUST UGLY ! (but there is no replace yet)
                var x = source.split_with("%f")
@@ -396,7 +396,7 @@ abstract class NitdocPage
                x = source.split_with("%L")
                source = x.join(location.line_end.to_s)
                source = source.simplify_path
-               return "<a target='_blank' title='Show source' href=\"{source.to_s}\">View Source</a>"
+               return "<a target='_blank' title='Show source' href=\"{source.to_s.html_escape}\">View Source</a>"
        end
 
        # MProject description template

diff --git a/src/doc/doc_templates.nit b/src/doc/doc_templates.nit
index 497c4cd..cbb625e 100644 (file)
--- a/src/doc/doc_templates.nit
+++ b/src/doc/doc_templates.nit
@@ -650,10 +650,10 @@ class TplLink
        # Link href
        var href: String is writable
 
-       # Text to display in the link
+       # The raw HTML content to display in the link
        var text: Streamable is writable
 
-       # Optional title
+       # The unescaped optional title.
        var title: nullable String = null is writable
 
        init with_title(href, text, title: String) do
@@ -663,11 +663,11 @@ class TplLink
 
        redef fun rendering do
                add "<a href=\""
-               add href
+               add href.html_escape
                add "\""
                if title != null then
                        add " title=\""
-                       add title.as(not null)
+                       add title.as(not null).html_escape
                        add "\""
                end
                add ">"