Additional HTML escaping for titles and metadata (#5276)

2025-07-11 09:43:17 +08:00
parent 0ce3ef6bd8
commit 36271d15f5
4 changed files with 9 additions and 7 deletions
@@ -8,8 +8,8 @@
          <a class="site-logo" href="{{ '/' | relative_url }}"><img src="{{ logo_path | relative_url }}" alt="{{ site.masthead_title | default: site.title }}"></a>
        {% endunless %}
        <a class="site-title" href="{{ '/' | relative_url }}">
-          {{ site.masthead_title | default: site.title }}
-          {% if site.subtitle %}<span class="site-subtitle">{{ site.subtitle }}</span>{% endif %}
+          {{ site.masthead_title | default: site.title | escape_once | strip }}
+          {% if site.subtitle %}<span class="site-subtitle">{{ site.subtitle | escape_once | strip }}</span>{% endif %}
        </a>
        <ul class="visible-links">
          {%- for link in site.data.navigation.main -%}