@@ -140,7 +140,7 @@ function Hallway (sites) {
140 if (line === '') { continue }
140 if (line === '') { continue }
141 const parts = line.replace(' ', '\t').split('\t')
141 const parts = line.replace(' ', '\t').split('\t')
142 const date = parts[0].trim()
142 const date = parts[0].trim()
143− const body = parts[1].trim()
143+ const body = escapeHtml(parts[1].trim()).trim()
144 const channel = body.substr(0, 1) === '/' ? body.split(' ')[0].substr(1).toLowerCase() : null
144 const channel = body.substr(0, 1) === '/' ? body.split(' ')[0].substr(1).toLowerCase() : null
145 const offset = new Date() - new Date(date)
145 const offset = new Date() - new Date(date)
146 entries.push({ date, body, author, offset, channel })
146 entries.push({ date, body, author, offset, channel })
@@ -174,4 +174,8 @@ function Hallway (sites) {
175 return `${Math.floor(minutes / 1440)} days ago`
175 return `${Math.floor(minutes / 1440)} days ago`
178+ function escapeHtml(unsafe) {
179+ return unsafe.replace(/&/g, "&").replace(/</g, "<").replace(/>/g, ">").replace(/"/g, """).replace(/'/g, "'");