From 7a7049b25bc151cda8ea464f5db5950ccb3618cc Mon Sep 17 00:00:00 2001
From: Omar Roth <omarroth@hotmail.com>
Date: Mon, 25 Feb 2019 17:54:55 -0600
Subject: [PATCH] Escape video titles in download widget

---
 src/invidious/views/watch.ecr | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/invidious/views/watch.ecr b/src/invidious/views/watch.ecr
index 3949245d..8f52d2d2 100644
--- a/src/invidious/views/watch.ecr
+++ b/src/invidious/views/watch.ecr
@@ -59,17 +59,17 @@
                     <label for="download_widget"><%= translate(locale, "Download as: ") %></label>
                     <select style="width:100%" name="download_widget" id="download_widget">
                     <% video_streams.each do |option| %>
-                        <option value='{"id":"<%= video.id %>","itag":"<%= option["itag"] %>","title":"<%= video.title.dump_unquoted %>-<%= video.id %>.mp4"}'>
+                        <option value='{"id":"<%= video.id %>","itag":"<%= option["itag"] %>","title":"<%= HTML.escape(video.title) %>-<%= video.id %>.mp4"}'>
                             <%= option["quality_label"] %> - <%= option["type"].split(";")[0] %> @ <%= option["fps"] %>fps - video only
                         </option>
                     <% end %>
                     <% audio_streams.each do |option| %>
-                        <option value='{"id":"<%= video.id %>","itag":"<%= option["itag"] %>","title":"<%= video.title.dump_unquoted %>-<%= video.id %>.mp4"}'>
+                        <option value='{"id":"<%= video.id %>","itag":"<%= option["itag"] %>","title":"<%= HTML.escape(video.title) %>-<%= video.id %>.mp4"}'>
                             <%= option["type"].split(";")[0] %> @ <%= option["bitrate"] %>k - audio only
                         </option>
                     <% end %>
                     <% fmt_stream.each do |option| %>
-                        <option value='{"id":"<%= video.id %>","itag":"<%= option["itag"] %>","title":"<%= video.title.dump_unquoted %>-<%= video.id %>.mp4"}'>
+                        <option value='{"id":"<%= video.id %>","itag":"<%= option["itag"] %>","title":"<%= HTML.escape(video.title) %>-<%= video.id %>.mp4"}'>
                             <%= itag_to_metadata?(option["itag"]).try &.["height"]? || "~240" %>p - <%= option["type"].split(";")[0] %>
                         </option>
                     <% end %>