Unescape HTML in image names for alt text

3 files changed, 11 insertions, 7 deletions

diff --git a/lib/markdown-inline.js b/lib/markdown-inline.js
index e2d40f8..0d4b89f 100644
--- a/lib/markdown-inline.js
+++ b/lib/markdown-inline.js
@@ -1,5 +1,6 @@
 var marked = require('ssb-marked')
 var u = require('./util')
+var unquote = u.unescapeHTML
 
 // based on ssb-markdown, which is Copyright (c) 2016 Dominic Tarr, MIT License
 
@@ -28,12 +29,6 @@ inlineRenderer.del = function(text) { return unquote(text) }
 inlineRenderer.mention = function(preceding, id) { return shortenIfLink(unquote((preceding||'') + id)) }
 inlineRenderer.hashtag = function(preceding, tag) { return unquote((preceding||'') + tag) }
 
-function unquote (text) {
-  return text.replace(/&/g, '&').replace(/"/g, '"').replace(/'/g, '\'')
-    .replace(/>/g, '>')
-    .replace(/&lt;/g, '<')
-}
-
 function shortenIfLink (text) {
   return (u.ssbRefRegex.test(text.trim())) ? text.slice(0, 8) : text
 }
diff --git a/lib/render.js b/lib/render.js
index 045cf86..dbfd673 100644
--- a/lib/render.js
+++ b/lib/render.js
@@ -179,7 +179,7 @@ Render.prototype.imageUrl = function (ref) {
 Render.prototype.getImageAlt = function (id, fallback) {
   var link = this._mentionsByLink[id]
   if (!link) return fallback
-  var name = link.name || fallback
+  var name = u.unescapeHTML(link.name || fallback)
   return name
     + (link.size != null ? ' (' + this.formatSize(link.size) + ')' : '')
 }
diff --git a/lib/util.js b/lib/util.js
index 9f17966..58bb4b0 100644
--- a/lib/util.js
+++ b/lib/util.js
@@ -169,6 +169,15 @@ u.escapeHTML = function (html) {
     .replace(/>/g, '&gt;')
 }
 
+u.unescapeHTML = function (text) {
+  if (typeof text !== 'string') return text
+  return text.replace(/&amp;/g, '&')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, '\'')
+    .replace(/&gt;/g, '>')
+    .replace(/&lt;/g, '<')
+}
+
 u.pullSlice = function (start, end) {
   if (end == null) end = Infinity
   var offset = 0