Escape alt text in templatetag before marking safe.

twaddington · twaddington · commit b08820112f06 · 2024-08-29T15:13:40.000-07:00
Thanks to
Santos Gallegos at Read the Docs for reporting this issue.
diff --git a/django_gravatar/templatetags/gravatar.py b/django_gravatar/templatetags/gravatar.py
@@ -36,7 +36,7 @@ def gravatar(user_or_email, size=GRAVATAR_DEFAULT_SIZE, alt_text='', css_class='
     return mark_safe(
         '<img class="{css_class}" src="{src}" width="{width}"'
         ' height="{height}" alt="{alt}" />'.format(
-            css_class=css_class, src=url, width=size, height=size, alt=alt_text
+            css_class=css_class, src=url, width=size, height=size, alt=escape(alt_text)
         )
     )
 

Original file line number	Diff line number	Diff line change
`@@ -36,7 +36,7 @@ def gravatar(user_or_email, size=GRAVATAR_DEFAULT_SIZE, alt_text='', css_class='`
`36`	`36`	`return mark_safe(`
`37`	`37`	`'<img class="{css_class}" src="{src}" width="{width}"'`
`38`	`38`	`' height="{height}" alt="{alt}" />'.format(`
`39`		`- css_class=css_class, src=url, width=size, height=size, alt=alt_text`
	`39`	`+ css_class=css_class, src=url, width=size, height=size, alt=escape(alt_text)`
`40`	`40`	`)`
`41`	`41`	`)`
`42`	`42`