view: escape HTML description name

[public-inbox.git] / lib / PublicInbox / View.pm

diff --git a/lib/PublicInbox/View.pm b/lib/PublicInbox/View.pm
index 0b1ec75b31fd3f297bfcf85fdea29364ba5ede8a..9ef4712f313cc0bf59f21cbbf38fcbb8beeb0bac 100644 (file)
--- a/lib/PublicInbox/View.pm
+++ b/lib/PublicInbox/View.pm
@@ -438,6 +438,7 @@ sub attach_link ($$$$;$) {
        }
        $ret .= "[-- Attachment #$idx: ";
        my $ts = "Type: $ct, Size: $size bytes";
+       $desc = ascii_html($desc);
        $ret .= ($desc eq '') ? "$ts --]" : "$desc --]\n[-- $ts --]";
        $ret .= "</a>\n";
 }