Skip to content

Commit

Permalink
Escape any stray CDATA end tokens that may be in the post contents
Browse files Browse the repository at this point in the history
Normally you wouldn't have any CDATA end tokens ]]> in post content, because > gets converted to >. However, in certain circumstances, like HTML comments, one can slip through unescaped.

The only real way to escape CDATA end tokens is to split them up. I.e. instead of having a single string ]]>, we instead have ]](end CDATA)(start another CDATA)>. The two adjacent CDATAs will then be concatenated. That looks like this very messy string: ]]]]><![CDATA[>
  • Loading branch information
Kronopath committed Nov 14, 2023
1 parent 7d9c3a4 commit d7c0c3f
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 3 deletions.
6 changes: 4 additions & 2 deletions lib/jekyll-feed/feed.xml
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,8 @@
{% endunless %}
{% assign posts = posts | sort: "date" | reverse %}
{% assign posts_limit = site.feed.posts_limit | default: 10 %}
{% assign cdata_end_token = "]]>" %}
{% assign cdata_end_token_escaped = "]]]]><![CDATA[>" %}
{% for post in posts limit: posts_limit %}
<entry{% if post.lang %}{{" "}}xml:lang="{{ post.lang }}"{% endif %}>
{% assign post_title = post.title | smartify | strip_html | normalize_whitespace | xml_escape %}
Expand All @@ -63,7 +65,7 @@
<id>{{ post.id | absolute_url | xml_escape }}</id>
{% assign excerpt_only = post.feed.excerpt_only | default: site.feed.excerpt_only %}
{% unless excerpt_only %}
<content type="html" xml:base="{{ post.url | absolute_url | xml_escape }}"><![CDATA[{{ post.content | strip }}]]></content>
<content type="html" xml:base="{{ post.url | absolute_url | xml_escape }}"><![CDATA[{{ post.content | strip | replace: cdata_end_token, cdata_end_token_escaped }}]]></content>
{% endunless %}

{% assign post_author = post.author | default: post.authors[0] | default: site.author %}
Expand Down Expand Up @@ -96,7 +98,7 @@

{% assign post_summary = post.description | default: post.excerpt %}
{% if post_summary and post_summary != empty %}
<summary type="html"><![CDATA[{{ post_summary | strip_html | normalize_whitespace }}]]></summary>
<summary type="html"><![CDATA[{{ post_summary | strip_html | normalize_whitespace | replace: cdata_end_token, cdata_end_token_escaped }}]]></summary>
{% endif %}

{% assign post_image = post.image.path | default: post.image %}
Expand Down
2 changes: 1 addition & 1 deletion spec/fixtures/_posts/2014-03-04-march-the-fourth.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,4 @@ image:
categories: updates jekyll
---

March the fourth!
<!-- ]]> -->March the fourth!

0 comments on commit d7c0c3f

Please sign in to comment.