From bce381376ac68bb8baaf648eed0f5dc2d9dd6e52 Mon Sep 17 00:00:00 2001
From: n9k <originalcocaineninja@protonmail.com>
Date: Sun, 24 Jul 2022 11:01:03 +0000
Subject: [PATCH] Emotes: HTML-escape <img> `src` attribute

---
 anonstream/helpers/chat.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/anonstream/helpers/chat.py b/anonstream/helpers/chat.py
index 81a517f..cd005ff 100644
--- a/anonstream/helpers/chat.py
+++ b/anonstream/helpers/chat.py
@@ -25,7 +25,7 @@ def get_emote_markup(emote_name, emote_file, emote_width, emote_height):
     emote_name_markup = escape(emote_name)
     return Markup(
         f'''<img class="emote" '''
-        f'''src="{url_for('static', filename=emote_file)}" '''
+        f'''src="{escape(url_for('static', filename=emote_file))}" '''
         f'''width="{escape(emote_width)}" height="{escape(emote_height)}" '''
         f'''alt="{emote_name_markup}" title="{emote_name_markup}">'''
     )