Escape text-only flairs

* Encode HTML characters in flairs

* Encode HTML characters in flairs

* Use esc! macro for HTML escaping

Co-authored-by: spikecodes <19519553+spikecodes@users.noreply.github.com>

Cargo.lock

@@ -609,7 +609,7 @@ checksum = "12b8adadd720df158f4d70dfe7ccc6adb0472d7c55ca83445f6a5ab3e36f8fb6"
 
 [[package]]
 name = "libreddit"
-version = "0.14.10"
+version = "0.14.12"
 dependencies = [
  "askama",
  "async-recursion",

Cargo.toml

@@ -3,7 +3,7 @@ name = "libreddit"
 description = " Alternative private front-end to Reddit"
 license = "AGPL-3.0"
 repository = "https://github.com/spikecodes/libreddit"
-version = "0.14.10"
+version = "0.14.12"
 authors = ["spikecodes <19519553+spikecodes@users.noreply.github.com>"]
 edition = "2018"
 

src/main.rs

@@ -1,7 +1,7 @@
 // Global specifiers
 #![forbid(unsafe_code)]
 #![warn(clippy::pedantic, clippy::all)]
-#![allow(clippy::needless_pass_by_value, clippy::cast_possible_truncation, clippy::cast_possible_wrap, clippy::manual_find_map)]
+#![allow(clippy::needless_pass_by_value, clippy::cast_possible_truncation, clippy::cast_possible_wrap, clippy::manual_find_map, clippy::unused_async)]
 
 // Reference local files
 mod post;

src/utils.rs

@@ -39,7 +39,7 @@ impl FlairPart {
 						Self {
 							flair_part_type: value("e").to_string(),
 							value: match value("e") {
-								"text" => value("t").to_string(),
+								"text" => esc!(value("t")),
 								"emoji" => format_url(value("u")),
 								_ => String::new(),
 							},
@@ -52,7 +52,7 @@ impl FlairPart {
 			"text" => match text_flair {
 				Some(text) => vec![Self {
 					flair_part_type: "text".to_string(),
-					value: text.to_string(),
+					value: esc!(text),
 				}],
 				None => Vec::new(),
 			},
@@ -568,27 +568,17 @@ pub fn val(j: &Value, k: &str) -> String {
 	j["data"][k].as_str().unwrap_or_default().to_string()
 }
 
+// Escape < and > to accurately render HTML
 #[macro_export]
 macro_rules! esc {
 	($f:expr) => {
-		$f.replace('<', "&lt;").replace('>', "&gt;")
+		$f.replace('&', "&amp;").replace('<', "&lt;").replace('>', "&gt;")
 	};
 	($j:expr, $k:expr) => {
 		$j["data"][$k].as_str().unwrap_or_default().to_string().replace('<', "&lt;").replace('>', "&gt;")
 	};
 }
 
-// Escape < and > to accurately render HTML
-// pub fn esc(j: &Value, k: &str) -> String {
-// 	val(j,k)
-// 		// .replace('&', "&amp;")
-// 		.replace('<', "&lt;")
-// 		.replace('>', "&gt;")
-// 		// .replace('"', "&quot;")
-// 		// .replace('\'', "&#x27;")
-// 		// .replace('/', "&#x2f;")
-// }
-
 //
 // NETWORKING
 //

static/style.css

@@ -24,6 +24,7 @@
 	--post: #161616;
 	--panel-border: 1px solid #333;
 	--highlighted: #333;
+	--visited: #aaa;
 	--shadow: 0 1px 3px rgba(0, 0, 0, 0.5);
 }
 
@@ -39,6 +40,7 @@
 		--post: #eee;
 		--panel-border: 1px solid #ccc;
 		--highlighted: white;
+		--visited: #555;
 		--shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
 	}
 }
@@ -54,6 +56,7 @@
 	--post: #eee;
 	--panel-border: 1px solid #ccc;
 	--highlighted: white;
+	--visited: #555;
 	--shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
 }
 
@@ -68,6 +71,7 @@
 	--post: black;
 	--panel-border: 2px solid #0f0f0f;
 	--highlighted: #0f0f0f;
+	--visited: #aaa;
 	--shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
 }
 
@@ -78,10 +82,11 @@
 	--text: #f8f8f2;
 	--foreground: #3d4051;
 	--background: #282a36;
-	--outside: #44475a;
+	--outside: #393c4d;
-	--post: #44475a;
+	--post: #333544;
 	--panel-border: 2px solid #44475a;
 	--highlighted: #4e5267;
+	--visited: #969692;
 	--shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
 }
 
@@ -96,6 +101,7 @@
 	--post: #434c5e;
 	--panel-border: 2px solid #4c566a;
 	--highlighted: #3b4252;
+	--visited: #a3a5aa;
 	--shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
 }
 
@@ -110,6 +116,7 @@
 	--post: #3e3647;
 	--panel-border: 2px solid #2f2738;
 	--highlighted: #302a36;
+	--visited: #91889b;
 	--shadow: 0 1px 3px rgba(0, 0, 0, 0.1);
 }
 
@@ -124,6 +131,7 @@
 	--post: #181c3a;
 	--panel-border: 1px solid #1F2347;
 	--highlighted: #1F2347;
+	--visited: #aaa;
 	--shadow: 0 2px 5px rgba(0, 0, 0, 0.5);
 }
 
@@ -138,6 +146,7 @@
 	--post: #1b2936;
 	--panel-border: 0px solid black;
 	--highlighted: #234;
+	--visited: #aaa;
 	--shadow: 0 2px 5px rgba(0, 0, 0, 0.5);
 }
 
@@ -713,6 +722,10 @@ a.search_subreddit:hover {
 	grid-area: post_title;
 }
 
+.post:not(.highlighted) .post_title a:visited {
+	color: var(--visited);
+}
+
 .post_notification {
 	grid-area: post_notification;
 	margin: 5px 15px;