fix(toc): use escaped text to generate toc from heading (#2898)

Fixes #2896
hexojs · Dec 11, 2017 · c8d47b8 · c8d47b8
1 parent dee3b03
commit c8d47b8
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/lib/plugins/helper/toc.js b/lib/plugins/helper/toc.js
@@ -1,6 +1,7 @@
 'use strict';
 
 var cheerio;
+const _ = require('lodash');
 
 function tocHelper(str, options) {
   options = options || {};
@@ -25,7 +26,7 @@ function tocHelper(str, options) {
   headings.each(function() {
     var level = +this.name[1];
     var id = $(this).attr('id');
-    var text = $(this).html();
+    var text = _.escape($(this).text());
 
     lastNumber[level - 1]++;
 

diff --git a/test/scripts/helpers/toc.js b/test/scripts/helpers/toc.js
@@ -17,7 +17,8 @@ describe('toc', () => {
     '<h3 id="title_1_3_1">Title 1.3.1</h3>',
     '<h1 id="title_2">Title 2</h1>',
     '<h2 id="title_2_1">Title 2.1</h2>',
-    '<h1 id="title_3">Title should escape &amp;, &lt;, &apos;, and &quot;</h1>'
+    '<h1 id="title_3">Title should escape &amp;, &lt;, &#39;, and &quot;</h1>',
+    '<h1 id="title_4"><a name="chapter1">Chapter 1 should be printed to toc</a></h1>'
   ].join('');
 
   var genResult = options => {
@@ -107,7 +108,13 @@ describe('toc', () => {
       '<li class="' + className + '-item ' + className + '-level-1">',
       '<a class="' + className + '-link" href="#title_3">',
       ifTrue(listNumber, '<span class="' + className + '-number">3.</span> ', ''),
-      '<span class="' + className + '-text">Title should escape &amp;, &lt;, &apos;, and &quot;</span>',
+      '<span class="' + className + '-text">Title should escape &amp;, &lt;, &#39;, and &quot;</span>',
+      '</a>',
+      '</li>',
+      '<li class="' + className + '-item ' + className + '-level-1">',
+      '<a class="' + className + '-link" href="#title_4">',
+      ifTrue(listNumber, '<span class="' + className + '-number">4.</span> ', ''),
+      '<span class="' + className + '-text">Chapter 1 should be printed to toc</span>',
       '</a>',
       '</li>'
     ].join('');