From 7424474bb1c5e72a684544bb17498578e12f084e Mon Sep 17 00:00:00 2001
From: Vitaly Takmazov
Date: Tue, 22 Jan 2019 20:36:11 +0300
Subject: Fix HTML escaping

---
 src/main/java/com/juick/util/MessageUtils.java | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'src/main/java/com/juick')

diff --git a/src/main/java/com/juick/util/MessageUtils.java b/src/main/java/com/juick/util/MessageUtils.java
index 5669a454..84c29807 100644
--- a/src/main/java/com/juick/util/MessageUtils.java
+++ b/src/main/java/com/juick/util/MessageUtils.java
@@ -144,6 +144,9 @@ public class MessageUtils {
     }
 
     public static String formatMessage(String msg) {
+        msg = msg.replaceAll("&", "&");
+        msg = msg.replaceAll("<", "&lt;");
+        msg = msg.replaceAll(">", "&gt;");
         // --
         // &mdash;
         msg = msg.replaceAll("((?<=\\s)|(?<=\\A))\\-\\-?((?=\\s)|(?=\\Z))", "$1&mdash;$2");
-- 
cgit v1.2.3