fix: missing xml escape for alt of preview image (#1113)

Preview image display error when `alt` contains '<' or '>' Co-authored-by: Cotes Chung <11371340+cotes2020@users.noreply.github.com>
cotes2020 · Jun 28, 2023 · 8b0fbf5 · 8b0fbf5
1 parent 2639f8e
commit 8b0fbf5
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/_layouts/home.html b/_layouts/home.html
@@ -63,7 +63,7 @@
             {% assign src = post.img_path | append: '/' | append: src | replace: '//', '/' %}
           {% endunless %}
 
-          {% assign alt = post.image.alt | default: 'Preview Image' %}
+          {% assign alt = post.image.alt | xml_escape | default: 'Preview Image' %}
 
           <img src="{{ src }}" w="17" h="10" alt="{{ alt }}" {{ lqip }}>
         {% endif %}

diff --git a/_layouts/post.html b/_layouts/post.html
@@ -31,7 +31,7 @@ <h1 data-toc-skip>{{ page.title }}</h1>
   {% if page.image %}
     {% capture src %}src="{{ page.image.path | default: page.image }}"{% endcapture %}
     {% capture class %}class="preview-img{% if page.image.no_bg %}{{ ' no-bg' }}{% endif %}"{% endcapture %}
-    {% capture alt %}alt="{{ page.image.alt | default: "Preview Image" }}"{% endcapture %}
+    {% capture alt %}alt="{{ page.image.alt | xml_escape | default: "Preview Image" }}"{% endcapture %}
 
     {% capture lqip %}
       {% if page.image.lqip %}