Fix escaping in art templates

Escape the string after calling upper to avoid distorting character escapes like & -> &AMP;
metabrainz · Nov 23, 2024 · f650dce · f650dce
1 parent d22ea95
commit f650dce
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 10 deletions.
diff --git a/listenbrainz/webserver/templates/art/svg-templates/designer-top-10-alt.svg b/listenbrainz/webserver/templates/art/svg-templates/designer-top-10-alt.svg
diff --git a/listenbrainz/webserver/templates/art/svg-templates/designer-top-10.svg b/listenbrainz/webserver/templates/art/svg-templates/designer-top-10.svg
diff --git a/listenbrainz/webserver/templates/art/svg-templates/designer-top-5.svg b/listenbrainz/webserver/templates/art/svg-templates/designer-top-5.svg
diff --git a/listenbrainz/webserver/templates/art/svg-templates/macros.j2 b/listenbrainz/webserver/templates/art/svg-templates/macros.j2
@@ -6,15 +6,15 @@
       {% set hostURL = '' %}
     {% endif %}
     <a href="{{ host }}/{{ entity }}/{{ mbid }}" target="_blank">
-      {{ name|upper }}
-      <title>{{ name }}</title>
+      {{ name|upper|e }}
+      <title>{{ name|e }}</title>
     </a>
   {%- else -%}
-    {{ name|upper }}
-    <title>{{ name }}</title>
+    {{ name|upper|e }}
+    <title>{{ name|e }}</title>
   {%- endif -%}
 {% endmacro %}
-
+ 
 {% macro render_image_link(entity, image) %}
   {% if image.entity_mbid %}
   <a href="/{{ entity }}/{{ image.entity_mbid }}" target="_blank">