Escape HTML in mention and URL display text

This commit is contained in:
Zed 2026-07-18 12:46:30 +02:00
commit 06c52473ab

View file

@ -233,9 +233,9 @@ proc replacedWith(runes: seq[Rune]; repls: openArray[ReplaceSlice];
symbol = $runes[rep.slice.a]
result.add a(symbol & name, href = "/search?f=tweets&q=%23" & name)
of rkMention:
result.add a($runes[rep.slice], href = rep.url, title = rep.display)
result.add a($runes[rep.slice], href = rep.url, title = escape(rep.display))
of rkUrl:
result.add a(rep.display, href = rep.url)
result.add a(escape(rep.display), href = rep.url)
of rkRemove:
discard