Encode attribute and text content in generated NCX

1 files changed, 4 insertions, 1 deletions

diff --git a/nov.el b/nov.el
index c8573d4..445e3c2 100644
--- a/nov.el
+++ b/nov.el
@@ -49,6 +49,7 @@
 (require 'image)
 (require 'shr)
 (require 'url-parse)
+(require 'xml)
 
 (require 'bookmark)
 (require 'imenu)
@@ -366,7 +367,9 @@ Each alist item consists of the identifier and full path."
              (label (car (esxml-node-children label-node))))
         (when (not href)
           (error "Navigation point is missing href attribute"))
-        (let ((link (format "<a href=\"%s\">%s</a>" href (or label href))))
+        (let ((link (format "<a href=\"%s\">%s</a>"
+                            (xml-escape-string href)
+                            (xml-escape-string (or label href)))))
           (if children
               (progn
                 (insert (format "<li>\n%s\n<ol>\n" link))