From f08e2a722d0b63be6260a1f1ca38cba055d0a415 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Jean-Christophe=20Beaupr=C3=A9?=
 <jcbrinfo@users.noreply.github.com>
Date: Fri, 12 Dec 2014 14:22:29 -0500
Subject: [PATCH] =?utf8?q?nitdoc:=20Escape=20links=E2=80=99=20attributes.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=utf8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jean-Christophe Beaupré <jcbrinfo@users.noreply.github.com>
---
 src/doc/doc_pages.nit     |    4 ++--
 src/doc/doc_templates.nit |    8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/doc/doc_pages.nit b/src/doc/doc_pages.nit
index ae2dde5..0d26ad6 100644
--- a/src/doc/doc_pages.nit
+++ b/src/doc/doc_pages.nit
@@ -386,7 +386,7 @@ abstract class NitdocPage
 		var source = ctx.opt_source.value
 		if source == null then
 			var url = location.file.filename.simplify_path
-			return "<a target='_blank' title='Show source' href=\"{url}\">View Source</a>"
+			return "<a target='_blank' title='Show source' href=\"{url.html_escape}\">View Source</a>"
 		end
 		# THIS IS JUST UGLY ! (but there is no replace yet)
 		var x = source.split_with("%f")
@@ -396,7 +396,7 @@ abstract class NitdocPage
 		x = source.split_with("%L")
 		source = x.join(location.line_end.to_s)
 		source = source.simplify_path
-		return "<a target='_blank' title='Show source' href=\"{source.to_s}\">View Source</a>"
+		return "<a target='_blank' title='Show source' href=\"{source.to_s.html_escape}\">View Source</a>"
 	end
 
 	# MProject description template
diff --git a/src/doc/doc_templates.nit b/src/doc/doc_templates.nit
index 497c4cd..cbb625e 100644
--- a/src/doc/doc_templates.nit
+++ b/src/doc/doc_templates.nit
@@ -650,10 +650,10 @@ class TplLink
 	# Link href
 	var href: String is writable
 
-	# Text to display in the link
+	# The raw HTML content to display in the link
 	var text: Streamable is writable
 
-	# Optional title
+	# The unescaped optional title.
 	var title: nullable String = null is writable
 
 	init with_title(href, text, title: String) do
@@ -663,11 +663,11 @@ class TplLink
 
 	redef fun rendering do
 		add "<a href=\""
-		add href
+		add href.html_escape
 		add "\""
 		if title != null then
 			add " title=\""
-			add title.as(not null)
+			add title.as(not null).html_escape
 			add "\""
 		end
 		add ">"
-- 
1.7.9.5