From: Jean-Christophe Beaupré <jcbrinfo@users.noreply.github.com>
Date: Fri, 12 Dec 2014 19:22:29 +0000 (-0500)
Subject: nitdoc: Escape links’ attributes.
X-Git-Tag: v0.7~10^2~2
X-Git-Url: http://nitlanguage.org

nitdoc: Escape links’ attributes.

Signed-off-by: Jean-Christophe Beaupré <jcbrinfo@users.noreply.github.com>
---

diff --git a/src/doc/doc_pages.nit b/src/doc/doc_pages.nit
index ae2dde5..0d26ad6 100644
--- a/src/doc/doc_pages.nit
+++ b/src/doc/doc_pages.nit
@@ -386,7 +386,7 @@ abstract class NitdocPage
 		var source = ctx.opt_source.value
 		if source == null then
 			var url = location.file.filename.simplify_path
-			return "<a target='_blank' title='Show source' href=\"{url}\">View Source</a>"
+			return "<a target='_blank' title='Show source' href=\"{url.html_escape}\">View Source</a>"
 		end
 		# THIS IS JUST UGLY ! (but there is no replace yet)
 		var x = source.split_with("%f")
@@ -396,7 +396,7 @@ abstract class NitdocPage
 		x = source.split_with("%L")
 		source = x.join(location.line_end.to_s)
 		source = source.simplify_path
-		return "<a target='_blank' title='Show source' href=\"{source.to_s}\">View Source</a>"
+		return "<a target='_blank' title='Show source' href=\"{source.to_s.html_escape}\">View Source</a>"
 	end
 
 	# MProject description template
diff --git a/src/doc/doc_templates.nit b/src/doc/doc_templates.nit
index 497c4cd..cbb625e 100644
--- a/src/doc/doc_templates.nit
+++ b/src/doc/doc_templates.nit
@@ -650,10 +650,10 @@ class TplLink
 	# Link href
 	var href: String is writable
 
-	# Text to display in the link
+	# The raw HTML content to display in the link
 	var text: Streamable is writable
 
-	# Optional title
+	# The unescaped optional title.
 	var title: nullable String = null is writable
 
 	init with_title(href, text, title: String) do
@@ -663,11 +663,11 @@ class TplLink
 
 	redef fun rendering do
 		add "<a href=\""
-		add href
+		add href.html_escape
 		add "\""
 		if title != null then
 			add " title=\""
-			add title.as(not null)
+			add title.as(not null).html_escape
 			add "\""
 		end
 		add ">"