File tree Expand file tree Collapse file tree 2 files changed +6
-1
lines changed Expand file tree Collapse file tree 2 files changed +6
-1
lines changed Original file line number Diff line number Diff line change @@ -123,7 +123,7 @@ def handle_regexp_HARD_BREAK target
123
123
# Reference to a local file relative to the output directory.
124
124
125
125
def handle_regexp_HYPERLINK ( target )
126
- url = target . text
126
+ url = CGI . escapeHTML ( target . text )
127
127
128
128
gen_url url , url
129
129
end
Original file line number Diff line number Diff line change @@ -836,6 +836,11 @@ def test_handle_regexp_HYPERLINK_irc
836
836
assert_equal '<a href="irc://irc.freenode.net/#ruby-lang">irc.freenode.net/#ruby-lang</a>' , link
837
837
end
838
838
839
+ def test_handle_regexp_HYPERLINK_escape
840
+ code = 'irc://irc.freenode.net/"><script>alert(`irc`)</script><a"'
841
+ assert_escaped '<script>' , code
842
+ end
843
+
839
844
def test_list_verbatim_2
840
845
str = "* one\n verb1\n verb2\n * two\n "
841
846
You can’t perform that action at this time.
0 commit comments