#45 Escape alt and title tags properly

Signed-off-by: James Hunt <10615884+thetwopct@users.noreply.github.com> Signed-off-by: James Hunt <10615884+thetwopct@users.noreply.github.com>
cncf · May 21, 2024 · 1a3b099 · 1a3b099
1 parent e7fae65
commit 1a3b099
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 4 deletions.
diff --git a/layouts/partials/footer.html b/layouts/partials/footer.html
@@ -58,7 +58,7 @@
         <div class="footer__logo-social-wrapper">
             {{ with .Site.Params.logo_on_black }}
             <a class="logo-link" href="{{ "/" | absLangURL }}">
-                <img loading="lazy" class="logo" width="150" height="40" src="{{ . | absURL }}" alt="{{ $.Site.Title }}"></a>
+                <img loading="lazy" class="logo" width="150" height="40" src="{{ . | absURL }}" alt="{{ $.Site.Title | safeHTMLAttr }}"></a>
             {{ end }}
 
             {{- partial "footer/social-links.html" . -}}

diff --git a/layouts/partials/footer/social-links.html b/layouts/partials/footer/social-links.html
@@ -13,7 +13,7 @@
         {{ range $validLinks }}
         <li>
             <a href="{{ .value }}" title="{{ i18n "social_link_title" (dict "SiteTitle" $siteTitle "Network" (humanize .key)) | default (printf "%s on %s" $siteTitle (humanize .key)) }}">
-                <img loading="lazy" width="31" height="31" src="{{ printf "/img/social-icons/%s.svg" .key }}" alt="{{ (humanize .key) }} Icon">
+                <img loading="lazy" width="31" height="31" src="{{ printf "/img/social-icons/%s.svg" .key }}" alt="{{ (humanize .key) | safeHTMLAttr }} icon">
             </a>
         </li>
         {{ end }}

diff --git a/layouts/partials/header.html b/layouts/partials/header.html
@@ -7,7 +7,7 @@
 
         {{ with .Site.Params.logo_on_white }}
         <a class="logo-link" href="{{ "/" | absLangURL }}">
-            <img class="logo" width="150" height="40" src="{{ . | absURL }}" alt="{{ $.Site.Title }}">
+            <img class="logo" width="150" height="40" src="{{ . | absURL }}" alt="{{ $.Site.Title | safeHTMLAttr }}">
         </a>
         {{ else }}
         <a class="site-title-link" href="{{ "/" | absLangURL }}">

diff --git a/layouts/shortcodes/img.html b/layouts/shortcodes/img.html
@@ -37,7 +37,7 @@
         src="{{ $src }}"
         width="{{ $width }}"
         height="{{ $height }}"
-        alt="{{ $alt }}"
+        alt="{{ $alt | safeHTMLAttr }}"
         loading="{{ $loading }}"
         >
   {{ if $caption}}