fix: missing xml escape for alt of preview image (cotes2020#1113)

PENEKhun · cotes2020 · web-flow · commit 8b0fbf5a8342 · 2023-06-28T14:23:27.000+08:00
Preview image display error when `alt` contains '&lt;' or '&gt;'


Co-authored-by: Cotes Chung &lt;11371340+cotes2020@users.noreply.github.com&gt;
diff --git a/_layouts/home.html b/_layouts/home.html
@@ -63,7 +63,7 @@
             {% assign src = post.img_path | append: '/' | append: src | replace: '//', '/' %}
           {% endunless %}
 
-          {% assign alt = post.image.alt | default: 'Preview Image' %}
+          {% assign alt = post.image.alt | xml_escape | default: 'Preview Image' %}
 
           <img src="{{ src }}" w="17" h="10" alt="{{ alt }}" {{ lqip }}>
         {% endif %}
diff --git a/_layouts/post.html b/_layouts/post.html
@@ -31,7 +31,7 @@ <h1 data-toc-skip>{{ page.title }}</h1>
   {% if page.image %}
     {% capture src %}src="{{ page.image.path | default: page.image }}"{% endcapture %}
     {% capture class %}class="preview-img{% if page.image.no_bg %}{{ ' no-bg' }}{% endif %}"{% endcapture %}
-    {% capture alt %}alt="{{ page.image.alt | default: "Preview Image" }}"{% endcapture %}
+    {% capture alt %}alt="{{ page.image.alt | xml_escape | default: "Preview Image" }}"{% endcapture %}
 
     {% capture lqip %}
       {% if page.image.lqip %}
