Escape angle brackets in help http route output

hubotio · Aug 8, 2012 · dc8ad3c · dc8ad3c
1 parent ec6309a
commit dc8ad3c
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/src/scripts/help.coffee b/src/scripts/help.coffee
@@ -52,7 +52,8 @@ helpContents = (name, commands) ->
 
 module.exports = (robot) ->
   robot.respond /help\s*(.*)?$/i, (msg) ->
-    cmds = robot.helpCommands()
+    cmds = robot.helpCommands().map (cmd) ->
+      cmd.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;')
 
     if msg.match[1]
       cmds = cmds.filter (cmd) ->