bugfix: prevent HTML injection in reference style link titles

diff --git a/markdown.awk b/markdown.awk
index 65e0aefe2bd3ed4da3f4d3a543cc12511c31b4f9..27d40156a414ed45f6053a758b1a9fa2f6cc254c 100755 (executable)
--- a/markdown.awk
+++ b/markdown.awk
@@ -145,11 +145,11 @@ function inline( line, LOCAL, len, code, href, guard ) {
       id = gensub(/^\[([^\n]+)\] ?\[([^\n]*)\].*/, "\\2", 1, line);
     if ( ! id ) id = text;
     if ( rl_href[id] && rl_title[id] ) {
-      return "<a href=\"" rl_href[id] "\" title=\"" rl_title[id] "\">" inline(text) "</a>" inline( substr( line, len + 1) );
+      return "<a href=\"" HTML(rl_href[id]) "\" title=\"" HTML(rl_title[id]) "\">" inline(text) "</a>" inline( substr( line, len + 1) );
     } else if ( rl_href[id] ) {
-      return "<a href=\"" rl_href[id] "\">" inline(text) "</a>" inline( substr( line, len + 1) );
+      return "<a href=\"" HTML(rl_href[id]) "\">" inline(text) "</a>" inline( substr( line, len + 1) );
     } else {
-      return "" substr(line, 1, len) inline( substr(line, len + 1) );
+      return "" HTML(substr(line, 1, len)) inline( substr(line, len + 1) );
     }
 
   # inline images
@@ -171,11 +171,11 @@ function inline( line, LOCAL, len, code, href, guard ) {
       id = gensub(/^!\[([^\n]+)\] ?\[([^\n]*)\].*/, "\\2", 1, line);
     if ( ! id ) id = text;
     if ( rl_href[id] && rl_title[id] ) {
-      return "<img src=\"" rl_href[id] "\" alt=\"" HTML(text) "\" title=\"" rl_title[id] "\" />" inline( substr( line, len + 1) );
+      return "<img src=\"" HTML(rl_href[id]) "\" alt=\"" HTML(text) "\" title=\"" HTML(rl_title[id]) "\" />" inline( substr( line, len + 1) );
     } else if ( rl_href[id] ) {
-      return "<img src=\"" rl_href[id] "\" alt=\"" HTML(text) "\" />" inline( substr( line, len + 1) );
+      return "<img src=\"" HTML(rl_href[id]) "\" alt=\"" HTML(text) "\" />" inline( substr( line, len + 1) );
     } else {
-      return "" substr(line, 1, len) inline( substr(line, len + 1) );
+      return "" HTML(substr(line, 1, len)) inline( substr(line, len + 1) );
     }
 
   #  ~~strikeout~~ (pandoc)
@@ -195,7 +195,7 @@ function inline( line, LOCAL, len, code, href, guard ) {
 
   # ignore embedded underscores (pandoc, php md)
   } else if ( match(line, "^[[:alnum:]](__|_)") ) {
-    return substr( line, 1, RLENGTH) inline( substr(line, RLENGTH + 1) );
+    return HTML(substr( line, 1, RLENGTH)) inline( substr(line, RLENGTH + 1) );
 
   #  __strong__$
   } else if ( match(line, "^__(([^_[:space:]]|" ieu ")|([^_[:space:]]|" ieu ")(" nu "|" ieu ")*([^_[:space:]]|" ieu "))__$") ) {