Escape RSS description as XML

This is to avoid including characters invalid for XML. Fixes gohugoio#3268
horgh · Oct 8, 2018 · 0494bc4 · moorereason · Oct 9, 2018 · horgh
1 parent 646a52a
commit 0494bc4
Show file tree

Hide file tree

Showing 6 changed files with 25 additions and 5 deletions.
diff --git a/docs/content/en/templates/rss.md b/docs/content/en/templates/rss.md
@@ -79,7 +79,7 @@ This is the default RSS template that ships with Hugo. It adheres to the [RSS 2.
       <pubDate>{{ .Date.Format "Mon, 02 Jan 2006 15:04:05 -0700" | safeHTML }}</pubDate>
       {{ with .Site.Author.email }}<author>{{.}}{{ with $.Site.Author.name }} ({{.}}){{end}}</author>{{end}}
       <guid>{{ .Permalink }}</guid>
-      <description>{{ .Summary | html }}</description>
+      <description>{{ .Summary | XML }}</description>
     </item>
     {{ end }}
   </channel>

diff --git a/hugolib/site_test.go b/hugolib/site_test.go
@@ -607,7 +607,7 @@ my_param = "baz"
 my_date = 2010-05-27T07:32:00Z
 categories = [ "hugo" ]
 +++
-Front Matter with Ordered Pages 4. This is longer content`
+Front Matter with Ordered Pages 4. <div>This is longer content with vertical tab: .</div>`
 
 var weightedSources = [][2]string{
 	{filepath.FromSlash("sect/doc1.md"), weightedPage1},

diff --git a/tpl/safe/init.go b/tpl/safe/init.go
@@ -73,6 +73,11 @@ func init() {
 			[][2]string{},
 		)
 
+		ns.AddMethodMapping(ctx.XML,
+			[]string{"XML"},
+			[][2]string{},
+		)
+
 		return ns
 
 	}

diff --git a/tpl/safe/safe.go b/tpl/safe/safe.go
@@ -14,6 +14,8 @@
 package safe
 
 import (
+	"bytes"
+	"encoding/xml"
 	"html/template"
 
 	"github.com/gohugoio/hugo/helpers"
@@ -69,3 +71,16 @@ func (ns *Namespace) SanitizeURL(a interface{}) (string, error) {
 	s, err := cast.ToStringE(a)
 	return helpers.SanitizeURL(s), err
 }
+
+// XML returns a string escaped as XML and flagged to not be escaped as HTML.
+func (ns *Namespace) XML(a interface{}) (template.HTML, error) {
+	s, err := cast.ToStringE(a)
+	if err != nil {
+		return "", err
+	}
+	var buf bytes.Buffer
+	if err := xml.EscapeText(&buf, []byte(s)); err != nil {
+		return "", err
+	}
+	return template.HTML(buf.String()), nil
+}
diff --git a/tpl/tplimpl/embedded/templates.autogen.go b/tpl/tplimpl/embedded/templates.autogen.go
diff --git a/tpl/tplimpl/embedded/templates/_default/rss.xml b/tpl/tplimpl/embedded/templates/_default/rss.xml
@@ -19,8 +19,8 @@
       <pubDate>{{ .Date.Format "Mon, 02 Jan 2006 15:04:05 -0700" | safeHTML }}</pubDate>
       {{ with .Site.Author.email }}<author>{{.}}{{ with $.Site.Author.name }} ({{.}}){{end}}</author>{{end}}
       <guid>{{ .Permalink }}</guid>
-      <description>{{ .Summary | html }}</description>
+      <description>{{ .Summary | XML }}</description>
     </item>
     {{ end }}
   </channel>
-</rss>
+</rss>