feat(feed): escape html in title and summary

inframanufaktur · Oct 23, 2022 · 4ea4653 · 4ea4653
1 parent b2e7ab5
commit 4ea4653
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/_src/feed.11ty.js b/_src/feed.11ty.js
@@ -1,14 +1,15 @@
+const { escape } = require('html-escaper')
 const { dateToRfc3339 } = require('@11ty/eleventy-plugin-rss')
 
 function renderFeedItem({ title, url, date, postIntro }) {
   return `
     <entry>
-      <title>${title}</title>
+      <title>${escape(title)}</title>
       <id>${url}</id>
       <link href="${url}" rel="alternate" />
       <published>${dateToRfc3339(new Date(date))}</published>
       <updated>${dateToRfc3339(new Date(date))}</updated>
-      ${postIntro ? `<summary>${postIntro}</summary>` : ''}
+      ${postIntro ? `<summary>${escape(postIntro)}</summary>` : ''}
     </entry>
   `
 }