From 7845e3d01ee608691c44328c2e9ef4f3394470af Mon Sep 17 00:00:00 2001
From: Vasilij Schneidermann <mail@vasilij.de>
Date: Sat, 21 Nov 2020 12:49:11 +0100
Subject: Encode attribute and text content in generated NCX

---
 nov.el | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'nov.el')

diff --git a/nov.el b/nov.el
index c8573d4..445e3c2 100644
--- a/nov.el
+++ b/nov.el
@@ -49,6 +49,7 @@
 (require 'image)
 (require 'shr)
 (require 'url-parse)
+(require 'xml)
 
 (require 'bookmark)
 (require 'imenu)
@@ -366,7 +367,9 @@ Each alist item consists of the identifier and full path."
              (label (car (esxml-node-children label-node))))
         (when (not href)
           (error "Navigation point is missing href attribute"))
-        (let ((link (format "<a href=\"%s\">%s</a>" href (or label href))))
+        (let ((link (format "<a href=\"%s\">%s</a>"
+                            (xml-escape-string href)
+                            (xml-escape-string (or label href)))))
           (if children
               (progn
                 (insert (format "<li>\n%s\n<ol>\n" link))
-- 
cgit v1.2.3