From 4461473aa6dd7ea82134e2dc571adb5ae9d0f26a Mon Sep 17 00:00:00 2001
From: Android <Android99@outlook.com>
Date: Sun, 13 Mar 2022 00:12:05 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E6=A0=87=E9=A2=98=E4=B8=AD=E5=B8=A6?=
 =?UTF-8?q?=E6=9C=89=20HTML=20=E5=85=B3=E9=94=AE=E5=AD=97=E6=97=B6?=
 =?UTF-8?q?=EF=BC=8C=E4=BC=9A=E7=A0=B4=E5=9D=8F=E7=9B=B8=E5=85=B3=E6=8E=A8?=
 =?UTF-8?q?=E8=8D=90=E7=9A=84=E6=B8=B2=E6=9F=93=E3=80=82?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 scripts/helpers/related_post.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/helpers/related_post.js b/scripts/helpers/related_post.js
index 2f8371a..327f89f 100644
--- a/scripts/helpers/related_post.js
+++ b/scripts/helpers/related_post.js
@@ -54,14 +54,14 @@ hexo.extend.helper.register('related_posts', function (currentPost, allPosts) {
         relatedPosts[i].cover === false
           ? relatedPosts[i].randomcover
           : relatedPosts[i].cover
-      result += `<div><a href="${this.url_for(relatedPosts[i].path)}" title="${relatedPosts[i].title}">`
+      result += `<div><a href="${this.url_for(relatedPosts[i].path)}" title="${this.escape_html(relatedPosts[i].title)}">`
       result += `<img class="cover" src="${this.url_for(cover)}" alt="cover">`
       if (dateType === 'created') {
         result += `<div class="content is-center"><div class="date"><i class="far fa-calendar-alt fa-fw"></i> ${this.date(relatedPosts[i].created, hexoConfig.date_format)}</div>`
       } else {
         result += `<div class="content is-center"><div class="date"><i class="fas fa-history fa-fw"></i> ${this.date(relatedPosts[i].updated, hexoConfig.date_format)}</div>`
       }
-      result += `<div class="title">${relatedPosts[i].title}</div>`
+      result += `<div class="title">${this.escape_html(relatedPosts[i].title)}</div>`
       result += '</div></a></div>'
     }