From ae14cd177cc0be15478725b4872ceb40e8f04df9 Mon Sep 17 00:00:00 2001
From: Zixuan Tan <42604099+frezcirno@users.noreply.github.com>
Date: Wed, 9 Apr 2025 01:40:02 +0800
Subject: [PATCH] Escape page metadata in post template (#884)

---
 layout/_macro/post.njk | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/layout/_macro/post.njk b/layout/_macro/post.njk
index e297189..304726c 100644
--- a/layout/_macro/post.njk
+++ b/layout/_macro/post.njk
@@ -19,8 +19,8 @@
     </span>
 
     <span hidden itemprop="post" itemscope itemtype="http://schema.org/CreativeWork">
-      <meta itemprop="name" content="{{ page.title + ' | ' + title }}">
-      <meta itemprop="description" content="{{ page.description }}">
+      <meta itemprop="name" content="{{ escape_html(page.title or '') + ' | ' + title }}">
+      <meta itemprop="description" content="{{ escape_html(page.description or '') }}">
     </span>
 
     {%- if post.header !== false %}
@@ -134,14 +134,14 @@
           <div class="post-nav">
             <div class="post-nav-item">
               {%- if prev %}
-                <a href="{{ url_for(prev.path) }}" rel="prev" title="{{ prev.title }}">
+                <a href="{{ url_for(prev.path) }}" rel="prev" title="{{ escape_html(prev.title or '') }}">
                   <i class="fa fa-angle-left"></i> {{ prev.title }}
                 </a>
               {%- endif %}
             </div>
             <div class="post-nav-item">
               {%- if next %}
-                <a href="{{ url_for(next.path) }}" rel="next" title="{{ next.title }}">
+                <a href="{{ url_for(next.path) }}" rel="next" title="{{ escape_html(next.title or '') }}">
                   {{ next.title }} <i class="fa fa-angle-right"></i>
                 </a>
               {%- endif %}