From dafb25cbfebd3aca8e6ade9535d37d7a77f7b814 Mon Sep 17 00:00:00 2001
From: Chayoung You <yousbe@gmail.com>
Date: Sun, 28 Feb 2016 22:07:10 +0900
Subject: [PATCH] Escape title and description

Follows after #4307.
---
 lib/site_template/_includes/footer.html | 6 +++---
 lib/site_template/_includes/head.html   | 4 ++--
 lib/site_template/_includes/header.html | 4 ++--
 lib/site_template/_layouts/page.html    | 2 +-
 lib/site_template/_layouts/post.html    | 2 +-
 lib/site_template/index.html            | 2 +-
 6 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/lib/site_template/_includes/footer.html b/lib/site_template/_includes/footer.html
index 72239f1c..1e4b2bc9 100644
--- a/lib/site_template/_includes/footer.html
+++ b/lib/site_template/_includes/footer.html
@@ -2,12 +2,12 @@
 
   <div class="wrapper">
 
-    <h2 class="footer-heading">{{ site.title }}</h2>
+    <h2 class="footer-heading">{{ site.title | escape }}</h2>
 
     <div class="footer-col-wrapper">
       <div class="footer-col footer-col-1">
         <ul class="contact-list">
-          <li>{{ site.title }}</li>
+          <li>{{ site.title | escape }}</li>
           <li><a href="mailto:{{ site.email }}">{{ site.email }}</a></li>
         </ul>
       </div>
@@ -29,7 +29,7 @@
       </div>
 
       <div class="footer-col footer-col-3">
-        <p>{{ site.description }}</p>
+        <p>{{ site.description | escape }}</p>
       </div>
     </div>
 
diff --git a/lib/site_template/_includes/head.html b/lib/site_template/_includes/head.html
index 1598d6fe..c6a6e0bc 100644
--- a/lib/site_template/_includes/head.html
+++ b/lib/site_template/_includes/head.html
@@ -4,9 +4,9 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
 
   <title>{% if page.title %}{{ page.title | escape }}{% else %}{{ site.title | escape }}{% endif %}</title>
-  <meta name="description" content="{% if page.excerpt %}{{ page.excerpt | strip_html | strip_newlines | truncate: 160 }}{% else %}{{ site.description }}{% endif %}">
+  <meta name="description" content="{% if page.excerpt %}{{ page.excerpt | strip_html | strip_newlines | truncate: 160 }}{% else %}{{ site.description | escape }}{% endif %}">
 
   <link rel="stylesheet" href="{{ "/css/main.css" | prepend: site.baseurl }}">
   <link rel="canonical" href="{{ page.url | replace:'index.html','' | prepend: site.baseurl | prepend: site.url }}">
-  <link rel="alternate" type="application/rss+xml" title="{{ site.title }}" href="{{ "/feed.xml" | prepend: site.baseurl | prepend: site.url }}">
+  <link rel="alternate" type="application/rss+xml" title="{{ site.title | escape }}" href="{{ "/feed.xml" | prepend: site.baseurl | prepend: site.url }}">
 </head>
diff --git a/lib/site_template/_includes/header.html b/lib/site_template/_includes/header.html
index b3f86db8..42d1425b 100644
--- a/lib/site_template/_includes/header.html
+++ b/lib/site_template/_includes/header.html
@@ -2,7 +2,7 @@
 
   <div class="wrapper">
 
-    <a class="site-title" href="{{ site.baseurl }}/">{{ site.title }}</a>
+    <a class="site-title" href="{{ site.baseurl }}/">{{ site.title | escape }}</a>
 
     <nav class="site-nav">
       <a href="#" class="menu-icon">
@@ -16,7 +16,7 @@
       <div class="trigger">
         {% for my_page in site.pages %}
           {% if my_page.title %}
-          <a class="page-link" href="{{ my_page.url | prepend: site.baseurl }}">{{ my_page.title }}</a>
+          <a class="page-link" href="{{ my_page.url | prepend: site.baseurl }}">{{ my_page.title | escape }}</a>
           {% endif %}
         {% endfor %}
       </div>
diff --git a/lib/site_template/_layouts/page.html b/lib/site_template/_layouts/page.html
index ce233ad7..01e4b2a9 100644
--- a/lib/site_template/_layouts/page.html
+++ b/lib/site_template/_layouts/page.html
@@ -4,7 +4,7 @@ layout: default
 <article class="post">
 
   <header class="post-header">
-    <h1 class="post-title">{{ page.title }}</h1>
+    <h1 class="post-title">{{ page.title | escape }}</h1>
   </header>
 
   <div class="post-content">
diff --git a/lib/site_template/_layouts/post.html b/lib/site_template/_layouts/post.html
index 3a0fb52e..2592391f 100644
--- a/lib/site_template/_layouts/post.html
+++ b/lib/site_template/_layouts/post.html
@@ -4,7 +4,7 @@ layout: default
 <article class="post" itemscope itemtype="http://schema.org/BlogPosting">
 
   <header class="post-header">
-    <h1 class="post-title" itemprop="name headline">{{ page.title }}</h1>
+    <h1 class="post-title" itemprop="name headline">{{ page.title | escape }}</h1>
     <p class="post-meta"><time datetime="{{ page.date | date_to_xmlschema }}" itemprop="datePublished">{{ page.date | date: "%b %-d, %Y" }}</time>{% if page.author %} • <span itemprop="author" itemscope itemtype="http://schema.org/Person"><span itemprop="name">{{ page.author }}</span></span>{% endif %}</p>
   </header>
 
diff --git a/lib/site_template/index.html b/lib/site_template/index.html
index 83d93985..9fbc9b70 100644
--- a/lib/site_template/index.html
+++ b/lib/site_template/index.html
@@ -12,7 +12,7 @@ layout: default
         <span class="post-meta">{{ post.date | date: "%b %-d, %Y" }}</span>
 
         <h2>
-          <a class="post-link" href="{{ post.url | prepend: site.baseurl }}">{{ post.title }}</a>
+          <a class="post-link" href="{{ post.url | prepend: site.baseurl }}">{{ post.title | escape }}</a>
         </h2>
       </li>
     {% endfor %}