fix($core): escape meta tags correctly (fix #2831) (#2832)

Fixes #2831
vuejs · May 17, 2021 · b877b3b · b877b3b
1 parent 38e9863
commit b877b3b
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/packages/@vuepress/core/lib/client/root-mixins/updateMeta.js b/packages/@vuepress/core/lib/client/root-mixins/updateMeta.js
@@ -1,4 +1,5 @@
 import unionBy from 'lodash/unionBy'
+import escape from 'escape-html'
 
 export default {
   // created will be called on both client and ssr
@@ -132,7 +133,7 @@ function renderPageMeta (meta) {
   return meta.map(m => {
     let res = `<meta`
     Object.keys(m).forEach(key => {
-      res += ` ${key}="${m[key]}"`
+      res += ` ${key}="${escape(m[key])}"`
     })
     return res + `>`
   }).join('\n    ')