From e8754afca2033d15c0b7e71447e0767e8705718f Mon Sep 17 00:00:00 2001
From: Joe Carstairs <me@joeac.net>
Date: Thu, 18 Jun 2026 19:03:24 +0100
Subject: [PATCH] blog/rss.xml escapes HTML

---
 http/src/blog/rss.uppxml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/http/src/blog/rss.uppxml b/http/src/blog/rss.uppxml
index 93955a9..66683e4 100644
--- a/http/src/blog/rss.uppxml
+++ b/http/src/blog/rss.uppxml
@@ -29,7 +29,14 @@ DATE_PUBLISHED_RFC_822="$(TZ=UT date --date="${POST_ID}" +"%a, %d %b %Y %H:%M:%S
 <description>${POST_DESCRIPTION:-${POST_TITLE}}</description>
 <content:encoded>
 #!
-pp "${SRC}/blog/$post" "${SITE_URL}"
+pp "${SRC}/blog/$post" "${SITE_URL}" \
+  | sed "s/&/\\&amp;/g" \
+  | sed "s/</\\&lt;/g" \
+  | sed "s/>/\\&gt;/g" \
+  | sed "s/\"/\\&quot;/g" \
+  | sed "s/'/\\&#x27;/g" \
+  | sed "s/\`/\\&#x60;/g" \
+  | sed "s/\\\$/\\\\\$/g"
 #!
 </content:encoded>
 <author>Joe Carstairs</author>