From 492739eca996a3bcc99bb27249829d448efe0311 Mon Sep 17 00:00:00 2001
From: Yorick van Pelt <yorick@yorickvanpelt.nl>
Date: Sat, 23 Sep 2023 15:53:06 +0200
Subject: [PATCH] calendar widget: escape html in popup

---
 bin/cal.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/bin/cal.py b/bin/cal.py
index 8cd0bbe..52fb8f2 100755
--- a/bin/cal.py
+++ b/bin/cal.py
@@ -10,6 +10,7 @@ import json
 import subprocess
 import sys
 import i3ipc
+import html
 from pathlib import Path
 
 if not Path("~/.gcalcli_oauth").expanduser().exists():
@@ -46,7 +47,7 @@ def authuser(evt):
 def tooltip(evt):
     # todo: location
     return f"""
-        <b>{evt["summary"]}</b>
+        <b>{html.escape(evt["summary"])}</b>
         {evt["s"].strftime("%b %d %H:%M")} - {evt["e"].strftime("%H:%M")}
     """