From cd4e873a4532922101555904700d690c43c375fd Mon Sep 17 00:00:00 2001
From: Zed <zedeus@pm.me>
Date: Fri, 21 Jun 2019 04:35:48 +0200
Subject: [PATCH] Escape tweet text

---
 src/views/tweet.nim | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/src/views/tweet.nim b/src/views/tweet.nim
index 6bd8879..503fd5c 100644
--- a/src/views/tweet.nim
+++ b/src/views/tweet.nim
@@ -92,23 +92,22 @@
 #
 #proc renderTweet*(tweet: Tweet; class=""): string =
 <div class="${class}">
-  <div class="status-el">
-    <div class="status-body">
-      ${renderHeading(tweet)}
-      <div class="status-content-wrapper">
-        <div class="status-content media-body">
-          ${linkifyText(tweet.text)}
-        </div>
+<div class="status-el">
+  <div class="status-body">
+    ${renderHeading(tweet)}
+    <div class="status-content-wrapper">
+      <div class="status-content media-body">
+        ${linkifyText(xmltree.escape(tweet.text))}
       </div>
-      #if tweet.photos.len > 0:
-        ${renderMediaGroup(tweet)}
-      #elif tweet.videoThumb.isSome:
-        ${renderVideo(tweet)}
-      #elif tweet.gif.isSome:
-        ${renderGif(tweet)}
-      #end if
-      ${renderStats(tweet)}
     </div>
+    #if tweet.photos.len > 0:
+    ${renderMediaGroup(tweet)}
+    #elif tweet.videoThumb.isSome:
+    ${renderVideo(tweet)}
+    #elif tweet.gif.isSome:
+    ${renderGif(tweet)}
+    #end if
+    ${renderStats(tweet)}
   </div>
 </div>
 #end proc