Escape URL parts on formatting local status (#4975)

2017-09-17 04:33:52 +09:00
parent c8969dca35
commit ec36df97c4
2 changed files with 17 additions and 1 deletions
--- a/app/lib/formatter.rb
+++ b/app/lib/formatter.rb
@ -137,7 +137,7 @@ class Formatter
    suffix = url[prefix.length + 30..-1]
    cutoff = url[prefix.length..-1].length > 30

-    "<span class=\"invisible\">#{prefix}</span><span class=\"#{cutoff ? 'ellipsis' : ''}\">#{text}</span><span class=\"invisible\">#{suffix}</span>"
+    "<span class=\"invisible\">#{encode(prefix)}</span><span class=\"#{cutoff ? 'ellipsis' : ''}\">#{encode(text)}</span><span class=\"invisible\">#{encode(suffix)}</span>"
  end

  def hashtag_html(tag)