marky

commit 757d7929b147e6e403ff5412f999d34364d6383e
parent 6b348de7805aa2ddd6a1a5d579fe53d6a36aec74
Author: David Eisinger <[email protected]>
Date:   Tue, 30 Dec 2025 22:21:31 -0500

Fix bookmarklet issue w/ quotation marks in title

Diffstat:
M
internal/api.go
 | 
10
++++++++--

1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/internal/api.go b/internal/api.go
@@ -138,9 +138,15 @@ func NewHandlerWithConfig(db *DB, cfg HandlerConfig) (http.Handler, error) {
 		if q.Get("p") != "" {
 			pub = q.Get("p")
 		}
-		// Escape text content for HTML text node
+		// Escape text content for HTML attribute/text node usage.
 		htmlEscape := func(s string) string {
-			r := strings.NewReplacer("&", "&amp;", "<", "&lt;", ">", "&gt;")
+			r := strings.NewReplacer(
+				"&", "&amp;",
+				"<", "&lt;",
+				">", "&gt;",
+				`"`, "&quot;",
+				"'", "&#39;",
+			)
 			return r.Replace(s)
 		}
 		// Prefer token from query string for incognito usage