[fix] html in attr not escaped

src/core/render/tpl.js

@@ -1,3 +1,5 @@
+import { escapeHtml } from './utils';
+
 /**
  * Render github corner
  * @param  {Object} data URL for the View Source on Github link
@@ -91,7 +93,9 @@ export function tree(toc, tpl = '<ul class="app-sub-sidebar">{inner}</ul>') {
 
   let innerHTML = '';
   toc.forEach(node => {
-    innerHTML += `<li><a class="section-link" href="${node.slug}" title="${node.title}">${node.title}</a></li>`;
+    innerHTML += `<li><a class="section-link" href="${
+      node.slug
+    }" title="${escapeHtml(node.title)}">${node.title}</a></li>`;
     if (node.children) {
       innerHTML += tree(node.children, tpl);
     }

src/core/render/utils.js

@@ -48,3 +48,20 @@ export function getAndRemoveConfig(str = '') {
 export function removeAtag(str = '') {
   return str.replace(/(<\/?a.*?>)/gi, '');
 }
+
+/**
+ * Escape html
+ * @param {String} string html string
+ * @returns {string} Return escaped html string
+ */
+export function escapeHtml(string) {
+  const entityMap = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+  };
+
+  return String(string).replace(/[&<>"']/g, s => entityMap[s]);
+}

src/plugins/search/search.js

@@ -1,5 +1,5 @@
 /* eslint-disable no-unused-vars */
-import { getAndRemoveConfig } from '../../core/render/utils';
+import { getAndRemoveConfig, escapeHtml } from '../../core/render/utils';
 
 let INDEXS = {};
 
@@ -20,18 +20,6 @@ function resolveIndexKey(namespace) {
     : LOCAL_STORAGE.INDEX_KEY;
 }
 
-function escapeHtml(string) {
-  const entityMap = {
-    '&': '&',
-    '<': '&lt;',
-    '>': '&gt;',
-    '"': '&quot;',
-    "'": '&#39;',
-  };
-
-  return String(string).replace(/[&<>"']/g, s => entityMap[s]);
-}
-
 function getAllPaths(router) {
   const paths = [];
 

test/unit/render-util.test.js

@@ -1,4 +1,4 @@
-const { removeAtag } = require(`${SRC_PATH}/core/render/utils`);
+const { removeAtag, escapeHtml } = require(`${SRC_PATH}/core/render/utils`);
 
 // Suite
 // -----------------------------------------------------------------------------
@@ -12,4 +12,16 @@ describe('core/render/utils', () => {
       expect(result).toEqual('content');
     });
   });
+
+  // escapeHtml()
+  // ---------------------------------------------------------------------------
+  describe('escapeHtml()', () => {
+    test('escape html', () => {
+      const result = escapeHtml('<a href="www.example.com">content</a>');
+
+      expect(result).toEqual(
+        '&lt;a href=&quot;www.example.com&quot;&gt;content&lt;/a&gt;'
+      );
+    });
+  });
 });