Escape <> in rendered toc

This commit is contained in:
David Tolnay 2020-11-08 21:58:53 -08:00
parent eaa6914205
commit c712ba7aab
No known key found for this signature in database
GPG Key ID: F9BA143B95FF6D82
1 changed files with 18 additions and 2 deletions

View File

@ -1,4 +1,5 @@
use std::collections::BTreeMap; use std::collections::BTreeMap;
use std::io;
use std::path::Path; use std::path::Path;
use crate::utils; use crate::utils;
@ -102,7 +103,7 @@ impl HelperDef for RenderToc {
// Part title // Part title
if let Some(title) = item.get("part") { if let Some(title) = item.get("part") {
out.write("<li class=\"part-title\">")?; out.write("<li class=\"part-title\">")?;
out.write(title)?; write_escaped(out, title)?;
out.write("</li>")?; out.write("</li>")?;
continue; continue;
} }
@ -160,7 +161,7 @@ impl HelperDef for RenderToc {
html::push_html(&mut markdown_parsed_name, parser); html::push_html(&mut markdown_parsed_name, parser);
// write to the handlebars template // write to the handlebars template
out.write(&markdown_parsed_name)?; write_escaped(out, &markdown_parsed_name)?;
} }
if path_exists { if path_exists {
@ -204,3 +205,18 @@ fn write_li_open_tag(
li.push_str("\">"); li.push_str("\">");
out.write(&li) out.write(&li)
} }
fn write_escaped(out: &mut dyn Output, mut title: &str) -> io::Result<()> {
let needs_escape: &[char] = &['<', '>'];
while let Some(next) = title.find(needs_escape) {
out.write(&title[..next])?;
match title.as_bytes()[next] {
b'<' => out.write("&lt;")?,
b'>' => out.write("&gt;")?,
_ => unreachable!(),
}
title = &title[next + 1..];
}
out.write(title)?;
Ok(())
}