From 636a78fed14a4e63317a14cdec8c4ea3cb25ff86 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Justin=20Nu=C3=9F?= <nuss.justin@gmail.com>
Date: Tue, 22 Jul 2014 20:08:04 +0200
Subject: [PATCH] Escape tags and quotes in links.

---
 models/repo.go | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/models/repo.go b/models/repo.go
index 1cfa50f7b..845c1b75a 100644
--- a/models/repo.go
+++ b/models/repo.go
@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"io/ioutil"
+	"html"
 	"html/template"
 	"os"
 	"path"
@@ -152,7 +153,13 @@ func (repo *Repository) GetOwner() (err error) {
 }
 
 func (repo *Repository) DescriptionHtml() template.HTML {
-	return template.HTML(DescriptionPattern.ReplaceAllString(repo.Description, `<a href="$0" target="_blank">$0</a>`))
+	sanitize := func(s string) string {
+		// TODO(nuss-justin): Improve sanitization. Strip all tags?
+		ss := html.EscapeString(s)
+
+		return fmt.Sprintf(`<a href="%s" target="_blank">%s</a>`, ss, ss)
+	}
+	return template.HTML(DescriptionPattern.ReplaceAllStringFunc(repo.Description, sanitize))
 }
 
 // IsRepositoryExist returns true if the repository with given name under user has already existed.