mugit: e50dc52

1 files changed, 3 insertions(+), 1 deletions(-)

ui: HTML-escape plain text readmes

Author: Oleksandr Smirnov olexsmir@gmail.com

Committed at: 2026-03-20 18:32:47 +0200

Authored at: 2026-03-20 18:15:10 +0200

Change ID: yyqnsrukmxzzmswukzllpkolmkxoknvp

Parent: d68c296

M internal/handlers/repo.go

···
        3
        3
         import (

      
        4
        4
         	"errors"

      
        5
        5
         	"fmt"

      
        
        6
        +	"html"

      
        6
        7
         	"html/template"

      
        7
        8
         	"log/slog"

      
        8
        9
         	"net/http"

      ···
        474
        475
         				return template.HTML(readme), nil

      
        475
        476
         

      
        476
        477
         			default:

      
        477
        
        -				readmeContents = template.HTML(fmt.Sprintf(`<pre class="raw">%s</pre>`, content))

      
        
        478
        +				readmeContents = template.HTML(fmt.Sprintf(

      
        
        479
        +					`<pre class="raw">%s</pre>`, html.EscapeString(content)))

      
        478
        480
         			}

      
        479
        481
         			break

      
        480
        482
         		}