From caee4870da2840be41948410c74eabe763e5e661 Mon Sep 17 00:00:00 2001 From: nickolas360 Date: Tue, 19 Jun 2018 02:06:05 -0700 Subject: [PATCH] HTML-escape text READMEs (#4192) (#4214) --- routers/repo/view.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/routers/repo/view.go b/routers/repo/view.go index 38694d92d6cb..737acb68bce2 100644 --- a/routers/repo/view.go +++ b/routers/repo/view.go @@ -105,7 +105,9 @@ func renderDirectory(ctx *context.Context, treeLink string) { ctx.Data["FileContent"] = string(markup.Render(readmeFile.Name(), buf, treeLink, ctx.Repo.Repository.ComposeMetas())) } else { ctx.Data["IsRenderedHTML"] = true - ctx.Data["FileContent"] = string(bytes.Replace(buf, []byte("\n"), []byte(`
`), -1)) + ctx.Data["FileContent"] = strings.Replace( + gotemplate.HTMLEscapeString(string(buf)), "\n", `
`, -1, + ) } } } @@ -208,7 +210,9 @@ func renderFile(ctx *context.Context, entry *git.TreeEntry, treeLink, rawLink st ctx.Data["FileContent"] = string(markup.Render(blob.Name(), buf, path.Dir(treeLink), ctx.Repo.Repository.ComposeMetas())) } else if readmeExist { ctx.Data["IsRenderedHTML"] = true - ctx.Data["FileContent"] = string(bytes.Replace(buf, []byte("\n"), []byte(`
`), -1)) + ctx.Data["FileContent"] = strings.Replace( + gotemplate.HTMLEscapeString(string(buf)), "\n", `
`, -1, + ) } else { // Building code view blocks with line number on server side. var fileContent string