Escape the tag title

README.md

@@ -2,5 +2,9 @@
 
 Tag Links is a Joplin plugin that inserts a list of tags of the note at the footer automatically. Those tags are clickable to search notes by the tag.
 
+![screenshot](https://raw.githubusercontent.com/benlau/joplin-plugin-tag-links/main/docs/screenshot.jpg)
 
+Known Issues
 
+- It does not works with the "Automatic backlinks" plugin
+- It could not refresh immediately when the tags are updated. 

src/index.ts

@@ -3,13 +3,21 @@ import { ContentScriptType } from 'api/types';
 
 const contentScriptId = "joplin-plugin-tag-links"
 
+const escape = document.createElement('textarea');
+
+function escapeHtml(html) {
+    escape.textContent = html;
+    return escape.innerHTML;
+}
+
 async function onMessage(message:any ) {
     if (message.type === "renderTags") {
         const activeNote = await joplin.workspace.selectedNote();
         const tags = await joplin.data.get(["notes", activeNote.id, "tags"])
         const links = tags.items.map( (item) => {
             const js = `onclick="webviewApi.postMessage('${contentScriptId}', {type:'openTag', tagId:'${item.id}'});return false;"`
-            return `<a class="joplinTagLinksLink" href="#" ${js}>${item.title}</a>`
+            const title = escapeHtml(item.title)
+            return `<a class="joplinTagLinksLink" href="#" ${js}>${title}</a>`
         })
         return `<div>${links.join("\n")}</div>`
     } else if (message.type == "openTag") {			

src/manifest.json

@@ -4,9 +4,9 @@
 	"app_min_version": "1.7",
 	"version": "0.1.0",
 	"name": "Tag Links",
-	"description": "Insert links of tag at the bottom of the note automatically",
+	"description": "Insert the link of tags at the footer automatically",
 	"author": "Ben Lau",
-	"homepage_url": "",
-	"repository_url": "",
+	"homepage_url": "https://github.com/benlau/joplin-plugin-tag-links",
+	"repository_url": "https://github.com/benlau/joplin-plugin-tag-links",
 	"keywords": []
 }