Skip to content

Escape conference text in inline JavaScript and HTML attributes #513

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JesperDramsch merged 3 commits into from
Oct 19, 2026
Merged

Escape conference text in inline JavaScript and HTML attributes #513

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
565cd63
Escape conference text in inline JavaScript with jsonify
claude Oct 19, 2026
730439f
Match script end tags with whitespace or attributes in the template test
claude Oct 19, 2026
babd3f2
Escape conference text in HTML attributes and reset the extended label
claude Oct 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions _includes/action_bar.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,9 @@
role="button"
tabindex="0"
data-conf-id="{{ conf_id }}"
data-conf-name="{{ include.conf_name }}"
data-conf-name="{{ include.conf_name | escape }}"
data-conf-cfp="{{ include.conf_cfp }}"
data-conf-place="{{ include.conf_place }}"
data-conf-place="{{ include.conf_place | escape }}"
aria-label="Conference actions">
<i class="fas fa-bookmark action-icon"></i>
</div>
Expand Down
17 changes: 9 additions & 8 deletions _includes/calendar.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,15 +124,16 @@ function load_conference_list() {
{% assign extended = "(extended)" %}
{% else %}
{% assign cfp = conf.cfp %}
{% assign extended = "" %}
{% endif %}
{% capture conf_date %}{%- translate_file dates/pretty_dates.html start=conf.start end=conf.end -%}{% endcapture %}
// add deadlines in red
conf_list_all.push({
id: "{{conf.conference | slugify: "latin"}}-{{conf.year}}-deadline",
abbreviation: "{{conf.conference | slugify: "latin"}}-{{conf.year}}",
name: "{{conf.conference}} {{conf.year}} CfP {{extended}}",
name: {{ conf.conference | append: " " | append: conf.year | append: " CfP " | append: extended | jsonify }},
color: "red",
location: "{{conf.place}}",
location: {{ conf.place | jsonify }},
date: "{{conf_date | strip}}",
subject: "{{conf.sub}}",
startDate: Date.parse("{{cfp}}"),
Expand All @@ -142,9 +143,9 @@ function load_conference_list() {
conf_list_all.push({
id: "{{conf.conference | slugify: "latin"}}-{{conf.year}}-deadline",
abbreviation: "{{conf.conference | slugify: "latin"}}-{{conf.year}}",
name: "{{conf.conference}} {{conf.year}} Workshop Deadline",
name: {{ conf.conference | append: " " | append: conf.year | append: " Workshop Deadline" | jsonify }},
color: "red",
location: "{{conf.place}}",
location: {{ conf.place | jsonify }},
date: "{{ conf_date | strip }}",
subject: "{{conf.sub}}",
startDate: Date.parse("{{conf.workshop_deadline}}"),
Expand All @@ -155,9 +156,9 @@ function load_conference_list() {
conf_list_all.push({
id: "{{conf.conference | slugify: "latin"}}-{{conf.year}}-deadline",
abbreviation: "{{conf.conference | slugify: "latin"}}-{{conf.year}}",
name: "{{conf.conference}} {{conf.year}} Tutorial Deadline",
name: {{ conf.conference | append: " " | append: conf.year | append: " Tutorial Deadline" | jsonify }},
color: "red",
location: "{{conf.place}}",
location: {{ conf.place | jsonify }},
date: "{{ conf_date | strip }}",
subject: "{{conf.sub}}",
startDate: Date.parse("{{cfp}}"),
Expand All @@ -177,9 +178,9 @@ function load_conference_list() {
conf_list_all.push({
id: "{{conf.conference | slugify: "latin"}}-{{conf.year}}-conference",
abbreviation: "{{conf.conference | slugify: "latin"}}-{{conf.year}}",
name: "{{conf.conference}} {{conf.year}}",
name: {{ conf.conference | append: " " | append: conf.year | jsonify }},
color: color,
location: "{{conf.place}}",
location: {{ conf.place | jsonify }},
date: "{{ conf_date | strip }}",
subject: "{{conf.sub}}",
startDate: Date.parse("{{conf.start}}"),
Expand Down
12 changes: 6 additions & 6 deletions _includes/conference_detail_actions.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,17 +5,17 @@
<div
class="conference-actions"
data-conf-id="{{ conf_id }}"
data-conf-name="{{ page.conference }}"
data-conf-name="{{ page.conference | escape }}"
data-conf-year="{{ page.year }}"
data-conf-cfp="{{ cfp_date }}"
data-conf-place="{{ page.place }}"
data-conf-place="{{ page.place | escape }}"
>
<!-- Save to Favorites Button -->
<button
class="btn-action btn-action-secondary btn-save-conference"
data-action="save"
data-conf-id="{{ conf_id }}"
aria-label="Save {{ page.conference }} {{ page.year }} to favorites"
aria-label="Save {{ page.conference | escape }} {{ page.year }} to favorites"
>
<i class="far fa-bookmark"></i>
<span class="btn-text">Save</span>
Expand All @@ -24,9 +24,9 @@
<!-- Follow Series Button (Primary CTA) -->
<button
class="btn-action btn-action-primary btn-follow-series"
data-series="{{ page.conference }}"
data-series="{{ page.conference | escape }}"
data-conf-id="{{ conf_id }}"
aria-label="Follow {{ page.conference }} series"
aria-label="Follow {{ page.conference | escape }} series"
>
<i class="fas fa-bell"></i>
<span class="btn-text">Follow Series</span>
Expand All @@ -38,7 +38,7 @@
class="btn-action btn-action-secondary btn-add-calendar"
data-action="calendar"
data-conf-id="{{ conf_id }}"
aria-label="Add {{ page.conference }} {{ page.year }} to calendar"
aria-label="Add {{ page.conference | escape }} {{ page.year }} to calendar"
>
<i class="far fa-calendar-plus"></i>
<span class="btn-text">Add to Calendar</span>
Expand Down
4 changes: 2 additions & 2 deletions _includes/index_conf_date_place.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,9 @@
{% if include.place == "Online" %}
<a href="#">{{include.place}}</a>
{% else %}
<a href="http://maps.google.com/?q={{include.place}}">{{include.place}}</a>
<a href="http://maps.google.com/?q={{ include.place | url_encode }}">{{include.place}}</a>
{% if include.extra_places %} {% for place in include.extra_places %} &
<a href="http://maps.google.com/?q={{place}}">{{place}}</a>
<a href="http://maps.google.com/?q={{ place | url_encode }}">{{place}}</a>
{% endfor %} {% endif %} {% endif %}
</span>
</div>
Expand Down
6 changes: 3 additions & 3 deletions _includes/index_conf_title_row.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,10 +21,10 @@
{% if conf.mastodon %}
<a title="Mastodon" href="{{conf.mastodon}}" target="_blank" rel="noopener noreferrer"><img src="/static/img/407-mastodon.svg" alt="Mastodon" width="14" height="14" /></a>
{% elsif conf.twitter %}
<a title="Twitter" href="https://twitter.com/{{conf.twitter}}" target="_blank" rel="noopener noreferrer"><img src="/static/img/407-twitter.svg" alt="Twitter" width="14" height="14" /></a>
<a title="Twitter" href="https://twitter.com/{{ conf.twitter | url_encode }}" target="_blank" rel="noopener noreferrer"><img src="/static/img/407-twitter.svg" alt="Twitter" width="14" height="14" /></a>
{% endif %}
{% if conf.bluesky %}
<a title="Bluesky" href="{{conf.bluesky}}" target="_blank" rel="noopener noreferrer"><i class="fa-brands fa-bluesky" style="width:14px;height:14px;" aria-hidden="true"></i></a>
<a title="Bluesky" href="{{ conf.bluesky | escape }}" target="_blank" rel="noopener noreferrer"><i class="fa-brands fa-bluesky" style="width:14px;height:14px;" aria-hidden="true"></i></a>
{% endif %}
</span>
</div>
Expand All @@ -36,7 +36,7 @@
<span class="timer-small">{{cfp_deadline}}</span>
{% else %}
<span class="timer">
<span class="countdown-display" data-deadline="{{cfp_deadline}}" data-timezone="{% if conf.timezone %}{{conf.timezone}}{% else %}UTC-12{% endif %}" role="timer" aria-live="off" aria-label="Countdown to {{conf.conference}} {{conf.year}} CFP deadline">{{cfp_deadline | date: "%b %e, %Y"}}</span>
<span class="countdown-display" data-deadline="{{cfp_deadline}}" data-timezone="{% if conf.timezone %}{{conf.timezone}}{% else %}UTC-12{% endif %}" role="timer" aria-live="off" aria-label="Countdown to {{ conf.conference | escape }} {{conf.year}} CFP deadline">{{cfp_deadline | date: "%b %e, %Y"}}</span>
</span>
<span class="timer-small">
<span class="countdown-display countdown-small" data-deadline="{{cfp_deadline}}" data-timezone="{% if conf.timezone %}{{conf.timezone}}{% else %}UTC-12{% endif %}" aria-hidden="true">{{cfp_deadline | date: "%b %e"}}</span>
Expand Down
32 changes: 16 additions & 16 deletions _layouts/conference.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,9 @@
<html>
<head>
{% include head.html %}
<meta name="description" content="Call for Proposals deadline for {{ page.conference }} {{ page.year }} in {{ page.place }}. Conference dates: {{ page.start | date: '%B %e' }} - {{ page.end | date: '%B %e, %Y' }}.">
<meta property="og:title" content="{{ page.conference }} {{ page.year }} - CFP Deadline">
<meta property="og:description" content="Call for Proposals deadline for {{ page.conference }} {{ page.year }} in {{ page.place }}. Submit your talk before {{ page.cfp_ext | default: page.cfp | date: '%B %e, %Y' }}.">
<meta name="description" content="Call for Proposals deadline for {{ page.conference | escape }} {{ page.year }} in {{ page.place | escape }}. Conference dates: {{ page.start | date: '%B %e' }} - {{ page.end | date: '%B %e, %Y' }}.">
<meta property="og:title" content="{{ page.conference | escape }} {{ page.year }} - CFP Deadline">
<meta property="og:description" content="Call for Proposals deadline for {{ page.conference | escape }} {{ page.year }} in {{ page.place | escape }}. Submit your talk before {{ page.cfp_ext | default: page.cfp | date: '%B %e, %Y' }}.">
<meta property="og:url" content="{{ site.url }}/conference/{{ page.conference | slugify: 'latin' }}-{{ page.year }}/">
<meta property="og:type" content="website">
<script type="application/ld+json">
Expand Down Expand Up @@ -77,9 +77,9 @@ <h2 id="conf-subtitle">a.k.a. {{page.alt_name}} {{page.year}}</h2>
</div>
<div id="page-content"
data-conf-id="{{page.conference | slugify: "latin"}}-{{page.year}}"
data-conf-name="{{page.conference}}"
data-conf-name="{{ page.conference | escape }}"
data-conf-year="{{page.year}}"
data-location="{{page.place}}"
data-location="{{ page.place | escape }}"
data-cfp="{{page.cfp}}"
data-cfp-ext="{{page.cfp_ext}}"
data-start="{{page.start}}"
Expand All @@ -93,7 +93,7 @@ <h2 id="conf-subtitle">a.k.a. {{page.alt_name}} {{page.year}}</h2>
data-timezone="{{ page.timezone | default: 'UTC-12' }}"
role="timer"
aria-live="off"
aria-label="Countdown to {{ page.conference }} {{ page.year }} CFP deadline">
aria-label="Countdown to {{ page.conference | escape }} {{ page.year }} CFP deadline">
{% if cfp == "TBA" or cfp == "Cancelled" or cfp == "None" %}{{cfp}}{%endif%}
</div>
</div>
Expand All @@ -112,7 +112,7 @@ <h2 id="conf-subtitle">a.k.a. {{page.alt_name}} {{page.year}}</h2>
<div>
<img src="/static/img/072-location.svg" class="badge-link" alt="Location icon" width="16" height="16" loading="lazy" />
<a id="conf-place" target="_blank" rel="noopener noreferrer"
href="{% if page.place == 'Online' %}#{% else %}https://maps.google.com/?q={{page.place}}{% endif %}">{{page.place}}</a>
href="{% if page.place == 'Online' %}#{% else %}https://maps.google.com/?q={{ page.place | url_encode }}{% endif %}">{{page.place}}</a>
</div>
<div>
<img src="/static/img/203-earth.svg" class="badge-link" alt="Earth Icon" width="16" height="16" loading="lazy" />
Expand Down Expand Up @@ -153,7 +153,7 @@ <h2 id="conf-subtitle">a.k.a. {{page.alt_name}} {{page.year}}</h2>
{% if page.twitter %}
<div>
<img src="/static/img/407-twitter.svg" class="badge-link" alt="Twitter icon" width="16" height="16" loading="lazy" />
<a id="conf-twitter" target="_blank" rel="noopener noreferrer" href="https://twitter.com/{{page.twitter}}">@{{page.twitter}}</a>
<a id="conf-twitter" target="_blank" rel="noopener noreferrer" href="https://twitter.com/{{ page.twitter | url_encode }}">@{{page.twitter}}</a>
</div>
{% endif %}
{% if page.mastodon %}
Expand All @@ -165,7 +165,7 @@ <h2 id="conf-subtitle">a.k.a. {{page.alt_name}} {{page.year}}</h2>
{% if page.bluesky %}
<div>
<i class="fa-brands fa-bluesky" style="width:16px;height:16px;" aria-hidden="true"></i>
<a id="conf-bluesky" target="_blank" rel="noopener noreferrer" href="{{page.bluesky}}">Bluesky</a>
<a id="conf-bluesky" target="_blank" rel="noopener noreferrer" href="{{ page.bluesky | escape }}">Bluesky</a>
</div>
{% endif %}
{% if page.youtube %}
Expand Down Expand Up @@ -194,23 +194,23 @@ <h2 id="conf-subtitle">a.k.a. {{page.alt_name}} {{page.year}}</h2>
</div>
<div class="row" id="conf-share-links">
<div class="col-12">
<a href="https://twitter.com/share?url={{site.url}}{{page.url}}&via=jesperdramsch&text=I%20found%20this%20Python%20conference:%20{{ page.conference }}%20{{page.year}}"
<a href="https://twitter.com/share?url={{site.url}}{{page.url}}&via=jesperdramsch&text=I%20found%20this%20Python%20conference:%20{{ page.conference | url_encode | replace: "+", "%20" }}%20{{page.year}}"
data-toggle="tooltip" title="Tweet on Twitter!">
{% t social.twitter %}
</a> |
<a href="https://www.linkedin.com/sharing/share-offsite/?url={{site.url}}{{page.url}}" data-toggle="tooltip"
title="Share on Linkedin!">
{% t social.linkedin %}
</a> |
<a href="https://www.facebook.com/sharer/sharer.php?u={{site.url}}{{page.url}}&t={{ page.conference }}%20{{page.year}}"
<a href="https://www.facebook.com/sharer/sharer.php?u={{site.url}}{{page.url}}&t={{ page.conference | url_encode | replace: "+", "%20" }}%20{{page.year}}"
data-toggle="tooltip" title="Share of Facebook!">
{% t social.facebook %}
</a> |
<a href="https://api.whatsapp.com/send?text=I%20found%20this%20Python%20conference:%20{{ page.conference }}%20{{page.year}}%20{{site.url}}{{page.url}}"
<a href="https://api.whatsapp.com/send?text=I%20found%20this%20Python%20conference:%20{{ page.conference | url_encode | replace: "+", "%20" }}%20{{page.year}}%20{{site.url}}{{page.url}}"
data-action="share/whatsapp/share" data-toggle="tooltip" title="Text on Whatsapp!">
{% t social.whatsapp %}
</a> |
<a href="mailto:?subject=Do%20you%20want%20to%20speak%20at%20{{ page.conference }}%20{{page.year}}&body=Hey,%20the%20CfP%20deadline%20for%20{{ page.conference }}%20{{page.year}}%20is%20approaching!%20%20{{site.url}}{{page.url}}"
<a href="mailto:?subject=Do%20you%20want%20to%20speak%20at%20{{ page.conference | url_encode | replace: "+", "%20" }}%20{{page.year}}&body=Hey,%20the%20CfP%20deadline%20for%20{{ page.conference | url_encode | replace: "+", "%20" }}%20{{page.year}}%20is%20approaching!%20%20{{site.url}}{{page.url}}"
data-toggle="tooltip" title="Email to a Friend!">
{% t social.email %}
</a>
Expand Down Expand Up @@ -347,10 +347,10 @@ <h2 id="conf-subtitle">a.k.a. {{page.alt_name}} {{page.year}}</h2>
const calendarType = $(this).data('calendar');

// Get conference data from page
const confName = '{{ page.conference }}';
const confName = {{ page.conference | jsonify }};
const confYear = '{{ page.year }}';
const cfpDate = '{{ page.cfp_ext | default: page.cfp }}';
const confPlace = '{{ page.place }}';
const confPlace = {{ page.place | jsonify }};

// Format the date for calendar
const eventDate = new Date(cfpDate);
Expand Down Expand Up @@ -417,7 +417,7 @@ <h2 id="conf-subtitle">a.k.a. {{page.alt_name}} {{page.year}}</h2>

// Initialize button states on page load
const confId = '{{ page.conference | slugify: "latin" }}-{{ page.year }}';
const seriesName = '{{ page.conference }}';
const seriesName = {{ page.conference | jsonify }};

if (window.confManager) {
// Update Follow Series button state
Expand Down
10 changes: 5 additions & 5 deletions _layouts/summary.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
<h1>
<span id="conf-title-href" href="{{site.baseurl_root}}/summary/{{page.conference | slugify: 'latin'}}/">{{title}}</span>
<span id="twitter-box"><a href="https://twitter.com/share" class="twitter-share-button"
data-text="Conference instances for the #{{ page.conference }} conference!" data-show-count="false"
data-text="Conference instances for the #{{ page.conference | escape }} conference!" data-show-count="false"
style="font-size:13px;">Tweet</a>
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</span>
Expand Down Expand Up @@ -62,7 +62,7 @@ <h1>
{% if confs[0].twitter %}
<div>
<img src="/static/img/407-twitter.svg" class="badge-link" alt="Twitter icon" width="16" height="16" />
<a id="conf-twitter" target="_blank" rel="noopener noreferrer" href="https://twitter.com/{{confs[0].twitter}}">@{{confs[0].twitter}}</a>
<a id="conf-twitter" target="_blank" rel="noopener noreferrer" href="https://twitter.com/{{ confs[0].twitter | url_encode }}">@{{confs[0].twitter}}</a>
</div>
{% endif %}
{% if confs[0].mastodon %}
Expand All @@ -74,7 +74,7 @@ <h1>
{% if confs[0].bluesky %}
<div>
<i class="fa-brands fa-bluesky" style="width:16px;height:16px;" aria-hidden="true"></i>
<a id="conf-bluesky" target="_blank" rel="noopener noreferrer" href="{{confs[0].bluesky}}">Bluesky</a>
<a id="conf-bluesky" target="_blank" rel="noopener noreferrer" href="{{ confs[0].bluesky | escape }}">Bluesky</a>
</div>
{% endif %}
{% if confs[0].youtube %}
Expand All @@ -91,9 +91,9 @@ <h1>
<div id="{{conf.conference | slugify: "latin"}}-{{conf.year}}"
class="ConfItem {% for sub in subs %} {{sub | strip}}-conf {% endfor %}"
data-conf-id="{{conf.conference | slugify: "latin"}}-{{conf.year}}"
data-conf-name="{{conf.conference}}"
data-conf-name="{{ conf.conference | escape }}"
data-conf-year="{{conf.year}}"
data-location="{{conf.place}}"
data-location="{{ conf.place | escape }}"
data-format="{% if conf.extra_places %}hybrid{% elsif conf.link contains 'virtual' or conf.place contains 'Virtual' or conf.place contains 'Online' %}virtual{% else %}in-person{% endif %}"
data-topics="{{conf.sub}}"
data-cfp="{{conf.cfp}}"
Expand Down
4 changes: 2 additions & 2 deletions _pages/series.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@
</span>
{% elsif conf.items[0].twitter %}
<span class="conf-title-icon">
<a title="Twitter for Conference" href="https://twitter.com/{{conf.items[0].twitter}}" target="_blank"><img src="/static/img/407-twitter.svg" class="badge-link" alt="Link to Conference Twitter" width="16" height="16" /></a>
<a title="Twitter for Conference" href="https://twitter.com/{{ conf.items[0].twitter | url_encode }}" target="_blank"><img src="/static/img/407-twitter.svg" class="badge-link" alt="Link to Conference Twitter" width="16" height="16" /></a>
&ZeroWidthSpace;
</span>
{% endif %}
Expand All @@ -82,7 +82,7 @@
{% if conf.items[idx].place == "Online" %}
<a href="#">{{conf.items[idx].place}}</a>
{% else %}
<a href="http://maps.google.com/?q={{conf.items[idx].place}}">{{conf.items[idx].place}}</a>
<a href="http://maps.google.com/?q={{ conf.items[idx].place | url_encode }}">{{conf.items[idx].place}}</a>
{% endif %}
</span>
</div>
Expand Down
Loading
Loading