Fix html escaping on var page header

zk · Sep 21, 2014 · 016ca0d · 016ca0d
1 parent 8107f7f
commit 016ca0d
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 3 deletions.
diff --git a/src/clj/clojuredocs/pages/vars.clj b/src/clj/clojuredocs/pages/vars.clj
@@ -20,8 +20,12 @@
   search/clojure-lib)
 
 (defn $arglist [name a]
-  [:li.arglist (str
-                 "(" name (when-not (empty? a) " ") a ")")])
+  [:li.arglist
+   (str "("
+        (util/html-encode name)
+        (when-not (empty? a) " ")
+        a
+        ")")])
 
 (defn see-alsos-for [{:keys [ns name library-url]}]
   (->> (mon/fetch :see-alsos
@@ -84,7 +88,7 @@
 (defn $var-header [{:keys [ns name added arglists] :as v}]
   [:div.row.var-header
    [:div.col-sm-8
-    [:h1.var-name name]]
+    [:h1.var-name (util/html-encode name)]]
    [:div.col-sm-4
     [:div.var-meta
      [:h4 [:a {:href (str "/" ns)} ns]]

diff --git a/src/cljx/clojuredocs/util.cljx b/src/cljx/clojuredocs/util.cljx
@@ -28,6 +28,13 @@
   (when s
     (java.net.URLEncoder/encode s)))
 
+#+clj
+(defn html-encode [s]
+  (when s
+    (-> s
+        (str/replace #"<" "&lt;")
+        (str/replace #">" "&gt;"))))
+
 (defn cd-decode [s]
   (when s
     (cond