Javadoc templates should escape/encode rendered data #2854
Labels
enhancement
An issue for a feature or an overall improvement
format: Javadoc
An issue/PR related to Dokka's Javadoc output format or the Javadoc comments in general
Dokka's Javadoc format uses HTML templates and maps to set page data, like in the following snippet from JavadocContentToTemplateMapTranslator:
As can be seen, the data used for values is used as is, whatever is returned from the method/property being called, which can lead to bug such as #2803 in case there's an internal mistake.
The data should be properly escaped/encoded, including the links (see #2813)
The text was updated successfully, but these errors were encountered: