From f98b158f36f7b6323bca657d539ed60cfd723a8d Mon Sep 17 00:00:00 2001
From: Takuma Ishikawa <nekketsuuu@users.noreply.github.com>
Date: Mon, 6 Jan 2020 17:39:55 +0900
Subject: Escape several strings, especially title (#71)

Co-authored-by: Yehonal <yehonal.azeroth@gmail.com>
---
 .../git-wiki/components/action_btn/page_actions.html | 20 ++++++++++----------
 _includes/git-wiki/components/lists/page-list.html   |  2 +-
 _includes/git-wiki/components/lists/post-list.html   |  2 +-
 _includes/git-wiki/components/logo/logo.html         |  2 +-
 _includes/git-wiki/sections/header/header.html       |  2 +-
 5 files changed, 14 insertions(+), 14 deletions(-)

(limited to '_includes')

diff --git a/_includes/git-wiki/components/action_btn/page_actions.html b/_includes/git-wiki/components/action_btn/page_actions.html
index 097dc51..b9151b4 100644
--- a/_includes/git-wiki/components/action_btn/page_actions.html
+++ b/_includes/git-wiki/components/action_btn/page_actions.html
@@ -5,28 +5,28 @@
     <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/wiki/{{url | remove: '.html' | append: ''}}/_history">History</a></span>
     <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/wiki/{{url | remove: '.html' | append: '.md'}}/">Source</a></span>
     {% else %}
-    <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/new/{{site.git_branch}}?filename={{ site.wiki_folder | default: 'wiki' }}/">Add
+    <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/new/{{site.git_branch | escape}}?filename={{ site.wiki_folder | default: 'wiki' }}/">Add
             new</a></span>
-    <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/edit/{{site.git_branch}}/{{page.path}}">Edit</a></span>
+    <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/edit/{{site.git_branch | escape}}/{{page.path | escape}}">Edit</a></span>
     {% if site.service == "gitlab" %}
-    <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/blob/{{site.git_branch}}/{{page.path}}">Delete</a></span>
+    <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/blob/{{site.git_branch | escape}}/{{page.path | escape}}">Delete</a></span>
     {% else %}
-    <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/delete/{{site.git_branch}}/{{page.path}}">Delete</a></span>
+    <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/delete/{{site.git_branch | escape}}/{{page.path | escape}}">Delete</a></span>
     {% endif %}
-    <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/commits/{{site.git_branch}}/{{page.path}}">History</a></span>
-    <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/blob/{{site.git_branch}}/{{page.path}}">Source</a></span>
+    <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/commits/{{site.git_branch | escape}}/{{page.path | escape}}">History</a></span>
+    <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/blob/{{site.git_branch | escape}}/{{page.path | escape}}">Source</a></span>
     {% if site.blog_feature %}
-    <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/new/{{site.git_branch}}?filename=_posts/">Add
+    <span class="tools-element"><a target="_blank" href="{{ site.github.repository_url }}/new/{{site.git_branch | escape}}?filename=_posts/">Add
             new post</a></span>
     {% endif %}
     {% if site.use_prose_io and site.service == "github" %}
     <br>
     Prose.io:
-    <span class="tools-element"><a target="_blank" href="http://prose.io/#{{site.github.repository_nwo}}/new/{{site.git_branch}}/{{ site.wiki_folder | default: 'wiki' }}">Add
+    <span class="tools-element"><a target="_blank" href="http://prose.io/#{{site.github.repository_nwo}}/new/{{site.git_branch | escape}}/{{ site.wiki_folder | default: 'wiki' }}">Add
             new</a></span>
-    <span class="tools-element"><a target="_blank" href="http://prose.io/#{{site.github.repository_nwo}}/edit/{{site.git_branch}}/{{page.path}}">Edit</a></span>
+    <span class="tools-element"><a target="_blank" href="http://prose.io/#{{site.github.repository_nwo}}/edit/{{site.git_branch | escape}}/{{page.path | escape}}">Edit</a></span>
     {% if site.blog_feature %}
-    <span class="tools-element"><a target="_blank" href="http://prose.io/#{{site.github.repository_nwo}}/new/{{site.git_branch}}/_posts/">Add
+    <span class="tools-element"><a target="_blank" href="http://prose.io/#{{site.github.repository_nwo}}/new/{{site.git_branch | escape}}/_posts/">Add
             new post</a></span>
     {% endif %}
     {% endif %}
diff --git a/_includes/git-wiki/components/lists/page-list.html b/_includes/git-wiki/components/lists/page-list.html
index dea6758..8129bf0 100644
--- a/_includes/git-wiki/components/lists/page-list.html
+++ b/_includes/git-wiki/components/lists/page-list.html
@@ -15,7 +15,7 @@
         {% if page.is_wiki_page != false and page.sitemap != false %}
         <li class="page-list-item">
             {% assign title = page.title | default: page.name %}
-            <a href="{{ page.url | relative_url }}">{{title}}</a>
+            <a href="{{ page.url | relative_url }}">{{title | escape}}</a>
         </li>
         {% assign numPages = numPages | plus: 1 %}
         {% endif %}
diff --git a/_includes/git-wiki/components/lists/post-list.html b/_includes/git-wiki/components/lists/post-list.html
index d6fa663..579dab5 100644
--- a/_includes/git-wiki/components/lists/post-list.html
+++ b/_includes/git-wiki/components/lists/post-list.html
@@ -15,7 +15,7 @@
 
         {% if post.layout != "null" and post.sitemap != false and post.title %}
         <li class="post-list-item">
-            <a href="{{ post.url | relative_url }}">{{ post.title}}</a>
+            <a href="{{ post.url | relative_url }}">{{ post.title | escape }}</a>
         </li>
         {% assign numPages = numPages | plus: 1 %}
         {% endif %}
diff --git a/_includes/git-wiki/components/logo/logo.html b/_includes/git-wiki/components/logo/logo.html
index d33305e..375b06b 100644
--- a/_includes/git-wiki/components/logo/logo.html
+++ b/_includes/git-wiki/components/logo/logo.html
@@ -1,6 +1,6 @@
 <div class="git-wiki-main-logo">
     <a href="{{ '/' | relative_url }}"><img src="{{ site.logo_url }}">
-        <h1>{{ site.title | default: site.github.repository_name }}</h1>
+        <h1>{{ site.title | default: site.github.repository_name | escape }}</h1>
     </a>
     <p>{{ site.description | default: site.github.project_tagline }}</p>
 </div>
\ No newline at end of file
diff --git a/_includes/git-wiki/sections/header/header.html b/_includes/git-wiki/sections/header/header.html
index 8c7f5bb..262bed9 100644
--- a/_includes/git-wiki/sections/header/header.html
+++ b/_includes/git-wiki/sections/header/header.html
@@ -3,8 +3,8 @@
   <a href="{{ '/' | relative_url }}">
     {% if site.logo_url %}
     <img src="{{ site.logo_url }}" width="20px">
+    {{ site.title | escape }}
     {% endif %}
-    {{ site.title }}
   </a>
 </div>
 <header class="w3-sidebar w3-bar-block w3-collapse" id="git-wiki-sidebar">
-- 
cgit