mirror/hugo
1
0
Fork 0
mirror of https://github.com/gohugoio/hugo.git synced 2025-09-01 22:42:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

tpl/tplimpl: Escape Markdown attributes in render hooks and shortcodes

Browse Source
This commit is contained in:
Joe Mooring
2024-12-04 14:01:31 -08:00
committed by Bjørn Erik Pedersen
parent b8c15f245b
commit 54398f8d57
7 changed files with 74 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
tpl/tplimpl/embedded/templates/_default/_markup/render-image.html
View File

@@ -1,7 +1,7 @@
{{- $u := urls.Parse .Destination -}}
{{- $src := $u.String -}}
{{- if not $u.IsAbs -}}
{{- $path := strings.TrimPrefix "./" $u.Path }}
{{- $path := strings.TrimPrefix "./" $u.Path -}}
{{- with or (.PageInner.Resources.Get $path) (resources.Get $path) -}}
{{- $src = .RelPermalink -}}
{{- with $u.RawQuery -}}
@@ -12,11 +12,12 @@
{{- end -}}
{{- end -}}
{{- end -}}
{{- $attributes := merge .Attributes (dict "alt" .Text "src" $src "title" (.Title | transform.HTMLEscape)) -}}
<img
{{- range $k, $v := $attributes -}}
<img src="{{ $src }}" alt="{{ .Text }}"
{{- with .Title }} title="{{ . }}" {{- end -}}
{{- range $k, $v := .Attributes -}}
{{- if $v -}}
{{- printf " %s=%q" $k $v | safeHTMLAttr -}}
{{- printf " %s=%q" $k ($v | transform.HTMLEscape) | safeHTMLAttr -}}
{{- end -}}
{{- end -}}>
{{- end -}}
>
{{- /**/ -}}

17
tpl/tplimpl/embedded/templates/_default/_markup/render-link.html
View File

@@ -1,9 +1,9 @@
{{- $u := urls.Parse .Destination -}}
{{- $href := $u.String -}}
{{- if strings.HasPrefix $u.String "#" }}
{{- $href = printf "%s#%s" .PageInner.RelPermalink $u.Fragment }}
{{- else if not $u.IsAbs -}}
{{- $path := strings.TrimPrefix "./" $u.Path }}
{{- if strings.HasPrefix $u.String "#" -}}
{{- $href = printf "%s#%s" .PageInner.RelPermalink $u.Fragment -}}
{{- else if and $href (not $u.IsAbs) -}}
{{- $path := strings.TrimPrefix "./" $u.Path -}}
{{- with or
($.PageInner.GetPage $path)
($.PageInner.Resources.Get $path)
@@ -18,12 +18,5 @@
{{- end -}}
{{- end -}}
{{- end -}}
{{- $attributes := dict "href" $href "title" (.Title | transform.HTMLEscape) -}}
<a
{{- range $k, $v := $attributes -}}
{{- if $v -}}
{{- printf " %s=%q" $k $v | safeHTMLAttr -}}
{{- end -}}
{{- end -}}
>{{ .Text }}</a>
<a href="{{ $href }}" {{- with .Title }} title="{{ . }}" {{- end }}>{{ .Text }}</a>
{{- /**/ -}}

2
tpl/tplimpl/embedded/templates/_default/_markup/render-table.html
View File

@@ -1,7 +1,7 @@
<table
{{- range $k, $v := .Attributes }}
{{- if $v }}
{{- printf " %s=%q" $k $v | safeHTMLAttr }}
{{- printf " %s=%q" $k ($v | transform.HTMLEscape) | safeHTMLAttr }}
{{- end }}
{{- end }}>
<thead>