sanitize origin query param in page title

juliuste · May 25, 2022 · be98f3a · be98f3a
1 parent 5915046
commit be98f3a
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/package.json b/package.json
@@ -19,6 +19,7 @@
 		"@formatjs/intl-localematcher": "^0.2.25",
 		"@mapbox/mapbox-gl-geocoder": "^4.7.4",
 		"get-user-locale": "^1.4.0",
+		"he": "^1.2.0",
 		"i18n-iso-countries": "^7.4.0",
 		"is-uic-location-code": "0.0.1",
 		"lodash": "^4.17.21",

diff --git a/src/index.js b/src/index.js
@@ -3,6 +3,7 @@
 import Sweetalert from 'sweetalert2'
 import mapboxGl from 'mapbox-gl'
 import MapboxGeocoder from '@mapbox/mapbox-gl-geocoder'
+import { encode } from 'he'
 import { sortBy } from 'lodash'
 import getQueryState from 'querystate'
 import { Duration } from 'luxon'
@@ -194,7 +195,7 @@ const selectLocation = async (id, local) => {
 	geocoder.setInput('')
 
 	const pageTitle = document.querySelector('title')
-	if (origin.name) pageTitle.innerHTML = [origin.name, translate('baseTitle')].join(' | ')
+	if (origin.name) pageTitle.innerHTML = [encode(origin.name), translate('baseTitle')].join(' | ')
 	const stationFeature = {
 		type: 'feature',
 		geometry: locationToPoint(origin.location),