templates: escape invalid XML

badge.js

@@ -27,6 +27,17 @@ templateFiles.forEach(function(filename) {
   templates[style + '-' + extension] = dot.template(templateData);
 });
 
+function escapeXml(s) {
+  return s.replace(/&/g, '&')
+          .replace(/</g, '&lt;')
+          .replace(/>/g, '&gt;')
+          .replace(/"/g, '&quot;')
+          .replace(/'/g, '&apos;');
+}
+function addEscapers(data) {
+  data.escapeXml = escapeXml;
+}
+
 var colorscheme = require(path.join(__dirname, 'colorscheme.json'));
 
 function optimize(string, callback) {
@@ -50,7 +61,10 @@ function makeImage(data, cb) {
     (canvasContext.measureText(data.text[0]).width|0) + 10,
     (canvasContext.measureText(data.text[1]).width|0) + 10,
   ];
+
+  addEscapers(data);
   var result = template(data);
+
   if (data.format === 'json') {
     cb(result);
   } else {

templates/default-template.svg

@@ -10,9 +10,9 @@
   <rect x="{{=it.widths[0]}}" width="4" height="18" fill="{{=it.colorB||"#4c1"}}"/>
   <rect rx="4" width="{{=it.widths[0]+it.widths[1]}}" height="18" fill="url(#smooth)"/>
   <g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
-    <text x="{{=it.widths[0]/2+1}}" y="14" fill="#010101" fill-opacity=".3">{{=it.text[0]}}</text>
-    <text x="{{=it.widths[0]/2+1}}" y="13">{{=it.text[0]}}</text>
-    <text x="{{=it.widths[0]+it.widths[1]/2-1}}" y="14" fill="#010101" fill-opacity=".3">{{=it.text[1]}}</text>
-    <text x="{{=it.widths[0]+it.widths[1]/2-1}}" y="13">{{=it.text[1]}}</text>
+    <text x="{{=it.widths[0]/2+1}}" y="14" fill="#010101" fill-opacity=".3">{{=it.escapeXml(it.text[0])}}</text>
+    <text x="{{=it.widths[0]/2+1}}" y="13">{{=it.escapeXml(it.text[0])}}</text>
+    <text x="{{=it.widths[0]+it.widths[1]/2-1}}" y="14" fill="#010101" fill-opacity=".3">{{=it.escapeXml(it.text[1])}}</text>
+    <text x="{{=it.widths[0]+it.widths[1]/2-1}}" y="13">{{=it.escapeXml(it.text[1])}}</text>
   </g>
 </svg>

templates/flat-square-template.svg

@@ -4,7 +4,7 @@
   <rect x="{{=it.widths[0]}}" width="4" height="20" fill="{{=it.colorB||"#4c1"}}"/>
   <rect width="{{=it.widths[0]+it.widths[1]}}" height="20" fill-opacity=".1"/>
   <g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
-    <text x="{{=it.widths[0]/2+1}}" y="14">{{=it.text[0]}}</text>
-    <text x="{{=it.widths[0]+it.widths[1]/2-1}}" y="14">{{=it.text[1]}}</text>
+    <text x="{{=it.widths[0]/2+1}}" y="14">{{=it.escapeXml(it.text[0])}}</text>
+    <text x="{{=it.widths[0]+it.widths[1]/2-1}}" y="14">{{=it.escapeXml(it.text[1])}}</text>
   </g>
 </svg>

templates/flat-template.svg

@@ -8,9 +8,9 @@
   <rect x="{{=it.widths[0]}}" width="4" height="20" fill="{{=it.colorB||"#4c1"}}"/>
   <rect rx="3" width="{{=it.widths[0]+it.widths[1]}}" height="20" fill="url(#smooth)"/>
   <g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
-    <text x="{{=it.widths[0]/2+1}}" y="15" fill="#010101" fill-opacity=".3">{{=it.text[0]}}</text>
-    <text x="{{=it.widths[0]/2+1}}" y="14">{{=it.text[0]}}</text>
-    <text x="{{=it.widths[0]+it.widths[1]/2-1}}" y="15" fill="#010101" fill-opacity=".3">{{=it.text[1]}}</text>
-    <text x="{{=it.widths[0]+it.widths[1]/2-1}}" y="14">{{=it.text[1]}}</text>
+    <text x="{{=it.widths[0]/2+1}}" y="15" fill="#010101" fill-opacity=".3">{{=it.escapeXml(it.text[0])}}</text>
+    <text x="{{=it.widths[0]/2+1}}" y="14">{{=it.escapeXml(it.text[0])}}</text>
+    <text x="{{=it.widths[0]+it.widths[1]/2-1}}" y="15" fill="#010101" fill-opacity=".3">{{=it.escapeXml(it.text[1])}}</text>
+    <text x="{{=it.widths[0]+it.widths[1]/2-1}}" y="14">{{=it.escapeXml(it.text[1])}}</text>
   </g>
 </svg>