Properly escape all relevant html entities

Avoid problems with files named things like '<img>' and so on.
isaacs · Feb 18, 2014 · 5a0c188 · alexrothenberg · Mar 24, 2014 · 5a0c188
1 parent 358c5fc
commit 5a0c188
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/st.js b/st.js
@@ -455,7 +455,13 @@ Mount.prototype._loadIndex = function (p, cb) {
 
     Object.keys(data).map(function (f) {
       var d = data[f]
-      var name = f.replace(/"/g, '&quot;')
+
+      var name = f
+          .replace(/"/g, '&quot;')
+          .replace(/>/g, '&lt;')
+          .replace(/</g, '&gt;')
+          .replace(/'/g, '&#39;')
+
       if (d.size === '-') name += '/'
       var showName = name.replace(/^(.{40}).{3,}$/, '$1..>')
       nameLen = Math.max(nameLen, showName.length)