From 06c52473ab46741d1d78cee0067b3751f1ada706 Mon Sep 17 00:00:00 2001 From: Zed Date: Sat, 18 Jul 2026 12:46:30 +0200 Subject: [PATCH] Escape HTML in mention and URL display text --- src/parserutils.nim | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/parserutils.nim b/src/parserutils.nim index 8db96a5..6fbed4f 100644 --- a/src/parserutils.nim +++ b/src/parserutils.nim @@ -233,9 +233,9 @@ proc replacedWith(runes: seq[Rune]; repls: openArray[ReplaceSlice]; symbol = $runes[rep.slice.a] result.add a(symbol & name, href = "/search?f=tweets&q=%23" & name) of rkMention: - result.add a($runes[rep.slice], href = rep.url, title = rep.display) + result.add a($runes[rep.slice], href = rep.url, title = escape(rep.display)) of rkUrl: - result.add a(rep.display, href = rep.url) + result.add a(escape(rep.display), href = rep.url) of rkRemove: discard