html escape font signature

2025-11-11 11:11:07 +02:00
parent daba2505bc
commit d7a6e80bb1
1 changed files with 2 additions and 0 deletions
@@ -20,6 +20,8 @@ module Submitters
    def call(text, font: nil)
      font = FONT_ALIASES[font] || font

+      text = ERB::Util.html_escape(text)
+
      text_image = Vips::Image.text(text, font:, fontfile: FONTS[font],
                                          width: WIDTH, height: HEIGHT, wrap: :none)