 
     reframe = (url) ->
       url = reUrl url
-      return url if misc.isDomainUrl url
-      return rewrite.addCtrlParam url,config,'iframe'
+      return encodeHTML(url) if misc.isDomainUrl url
+      return encodeHTML(rewrite.addCtrlParam url,config,'iframe')
 
     rt.rule({tag:'iframe',attr:'src',rewrite:reframe})
     rt.rule({tag:'frame',attr:'src',rewrite:reframe})
 
-    reCSS = (css)-> rewrite.css css,config,baseRoot
+    reCSS = (css)-> encodeHTML(rewrite.css css,config,baseRoot)
     rt.rule({tag:'style',rewrite:reCSS})
     rt.rule({attr:'style',rewrite:reCSS})
 

                      rh = rewrite.url href,config
                      if misc.isDomainUrl rh # tertiary domain
                        # disableRewriteInternal = true
                        return href
                      else if misc.isDomainUrl href
                        href = 'http:' + href if href.slice(0,2)=='//'
                        [scheme,host,path] = parseUrl href
                        baseRoot = '/' + scheme + '://' + host + '/'

                      return rh

    rt = new HTMLRewriter(html)
    rt.rule({tag:'base',attr:'href',first:true,rewrite: rewriteBase})

HTMLRewriter = require './HTMLRewriter'

parseUrl = misc.parseUrl

###
Simple html encode only replace "<>"
###
encodeHTML = (html) ->
  return html.replace(/</g,'&lt;').replace(/>/g,'&gt;')


rewrite =
