ext/rinku/rinku.c
static void print_link(struct buf *ob, const uint8_t *link, size_t size)
{
	size_t i = 0, org;

	while (i < size) {
		org = i;

		while (i < size && link[i] != '"')
			i++;

		if (i > org)
			bufput(ob, link + org, i - org);

		if (i >= size)
			break;

		BUFPUTSL(ob, "&quot;");
		i++;
	}
}
/*
 * Rinku assumes valid HTML encoding for all input, but there's still
 * the case where a link can contain a double quote `"` that allows XSS.
 *
 * We need to properly escape the character we use for the `href` attribute
 * declaration
 */
Rinku assumes valid HTML encoding for all input, but there's still
the case where a link can contain a double quote `"` that allows XSS.

We need to properly escape the character we use for the `href` attribute
declaration
Rinku assumes valid HTML encoding for all input but there ' s still the case where a link can contain a double quote ` " ` that allows XSS . We need to properly escape the character we use for the ` href ` attribute declaration
static void print_link(struct buf *ob, const uint8_t *link, size_t size)
{
	size_t i = 0, org;
	while (i < size) {
		org = i;
		while (i < size && link[i] != '"')
			i++;
		if (i > org)
			bufput(ob, link + org, i - org);
		if (i >= size)
			break;
		BUFPUTSL(ob, "&quot;");
		i++;
	}
}
static void print_link ( struct buf * ob , const uint8_t * link , size_t size ) { size_t i = 0 , org ; while ( i < size ) { org = i ; while ( i < size && link [ i ] != ' ' ) i ++ ; if ( i > org ) bufput ( ob , link + org , i - org ) ; if ( i >= size ) break ; BUFPUTSL ( ob , " " ) ; i ++ ; } }
Rinku assumes valid HTML encoding for all input, but there's still
 the case where a link can contain a double quote `"` that allows XSS.
Rinku assumes valid HTML encoding for all input but there ' s still the case where a link can contain a double quote ` " ` that allows XSS .