safeHTML use should be avoided

[palant]

The theme currently uses safeHTML function a lot. This is very undesirable security-wise, and it is hard to verify that no XSS-vulnerabilities are introduced here. With merely few safeHTML calls reviewing its security implications would be much simpler.

For example in post-meta.html:

    {{ printf `<time datetime="%s" class="post-meta-item published">%s&nbsp;%s</time>` ($Deliver.PublishDate.Format "2006-01-02T15:04:05-07:00") $icon ($Deliver.PublishDate.Format $Deliver.Site.Params.postMetaDateFormat) | safeHTML }}

This should be:

    <time datetime="{{ $Deliver.PublishDate.Format "2006-01-02T15:04:05-07:00" }}" class="post-meta-item published">{{ $icon | safeHTML }}&nbsp;{{ $Deliver.PublishDate.Format $Deliver.Site.Params.postMetaDateFormat }}</time>

That's both safer (safeHTML applied only to the icon where it makes sense) and more readable. In fact, it might be a good idea to create a template for icons, so that safeHTML can be applied to icons in that one place only (as an added bonus, this template could replace the icon class as well).

Or in footer.html:

{{- partial "utils/markdownify.html" (dict "Deliver" $Deliver "raw" $raw "isContent" false) -}}
{{- $Content := .Scratch.Get "Content" -}}
<div class="powered-by">{{ $Content | safeHTML }}</div>

Here safeHTML should be removed because markdownify.html already applies it (either directly, or via markdownify function).

[palant]

I could create a pull request covering most of the necessary changes (the ones that I can test) if you are ok with that.

[reuixiy]

Yes, absolutely welcome!

I realized this problem after I finished this theme, but I was too lazy to check them one by one.

Feel free to fix these safeHTMLs :)