Page titles should be HTML safe and not contain any extraneous markup

app/helpers/blacklight/blacklight_helper_behavior.rb

@@ -15,13 +15,21 @@ module Blacklight::BlacklightHelperBehavior
   #  - the Rails configuration
   #  - an i18n string (key: blacklight.application_name; preferred)
   # 
-  # @return [String] the application named
+  # @return [String] the application name
   def application_name
     return Rails.application.config.application_name if Rails.application.config.respond_to? :application_name
 
     t('blacklight.application_name')
   end
 
+  ##
+  # Get the page's HTML title
+  #
+  # @return [String]
+  def render_page_title
+    strip_tags((content_for(:page_title) if content_for?(:page_title)) || @page_title || application_name).html_safe
+  end
+
   ##
   # Create <link rel="alternate"> links from a documents dynamically
   # provided export formats. Currently not used by standard BL layouts,

app/views/layouts/blacklight.html.erb

@@ -13,7 +13,7 @@
       <meta http-equiv="cleartype" content="on">
     <![endif]-->
 
-    <title><%= h(@page_title || application_name) %></title>
+    <title><%= render_page_title %></title>
     <link href="<%= opensearch_catalog_path(:format => 'xml', :only_path => false) %>" title="<%= application_name%>" type="application/opensearchdescription+xml" rel="search"/>
     <%= favicon_link_tag asset_path('favicon.ico') %>
     <%= stylesheet_link_tag    "application" %>

spec/helpers/blacklight_helper_spec.rb

@@ -32,6 +32,28 @@ def current_search_session
     end
   end
 
+  describe "#render_page_title" do
+    it "should look in content_for(:page_title)" do
+      helper.content_for(:page_title) { "xyz" }
+      expect(helper.render_page_title).to eq "xyz"
+    end
+
+    it "should look in the @page_title ivar" do
+      assign(:page_title, "xyz")
+      expect(helper.render_page_title).to eq "xyz"
+    end
+
+    it "should default to the application name" do
+      expect(helper.render_page_title).to eq helper.application_name
+    end
+
+    it "should be html safe and without any markup" do
+      assign(:page_title, "<a>&</a>")
+      expect(helper.render_page_title).to be_html_safe
+      expect(helper.render_page_title).to eq "&"
+    end
+  end
+
   describe "render_link_rel_alternates" do
       class MockDocumentAppHelper
         include Blacklight::Solr::Document