Use `safeHTMLAttr` in the `integrity` attributes.

diff --git a/site/layouts/_default/examples.html b/site/layouts/_default/examples.html
index 6142e29ad511ce3161582aa7d49dc60f65e68986..3fe1ac9bdd81ee5d2fee504da78a69555ad8b6da 100644 (file)
--- a/site/layouts/_default/examples.html
+++ b/site/layouts/_default/examples.html
@@ -44,13 +44,13 @@
 
     {{ if ne .Page.Params.include_js false -}}
       {{- if eq hugo.Environment "production" -}}
-        <script src="/docs/{{ .Site.Params.docs_version }}/dist/js/bootstrap.bundle.min.js" integrity="{{ .Site.Params.cdn.js_bundle_hash }}" crossorigin="anonymous"></script>
+        <script src="/docs/{{ .Site.Params.docs_version }}/dist/js/bootstrap.bundle.min.js" {{ printf "integrity=%q" .Site.Params.cdn.js_bundle_hash | safeHTMLAttr }} crossorigin="anonymous"></script>
       {{- else -}}
         <script src="/docs/{{ .Site.Params.docs_version }}/dist/js/bootstrap.bundle.js"></script>
       {{- end }}
 
       {{ range .Page.Params.extra_js -}}
-        <script{{ with .async }} async{{ end }} src="{{ .src }}"{{ with .integrity }} integrity="{{ . }}" crossorigin="anonymous"{{ end }}></script>
+        <script{{ with .async }} async{{ end }} src="{{ .src }}"{{ with .integrity }} {{ printf "integrity=%q" . | safeHTMLAttr }} crossorigin="anonymous"{{ end }}></script>
       {{- end -}}
     {{- end }}
   </body>

diff --git a/site/layouts/partials/home/masthead-followup.html b/site/layouts/partials/home/masthead-followup.html
index fcd24a611754bece6d37aaf3b8ef0fcc72e118ab..bf2a51cf07ecb48ed4ec3ec7cd41a1a42788e7f4 100644 (file)
--- a/site/layouts/partials/home/masthead-followup.html
+++ b/site/layouts/partials/home/masthead-followup.html
@@ -26,11 +26,11 @@
   <a class="btn btn-lg btn-outline-primary mb-4" href="/docs/{{ .Site.Params.docs_version }}/getting-started/introduction/">Explore the docs</a>
   <div class="text-left mx-md-5 px-md-5">
     <h5>CSS only</h5>
-    {{ highlight (printf (`<link rel="stylesheet" href="%s" integrity="%s" crossorigin="anonymous">`) .Site.Params.cdn.css .Site.Params.cdn.css_hash) "html" "" }}
+    {{ highlight (printf (`<link rel="stylesheet" href="%s" integrity=%q crossorigin="anonymous">`) .Site.Params.cdn.css (.Site.Params.cdn.css_hash | safeHTMLAttr)) "html" "" }}
     <h5>JS and Popper.js</h5>
-    {{ highlight (printf (`<script src="%s" integrity="%s" crossorigin="anonymous"></script>
-<script src="%s" integrity="%s" crossorigin="anonymous"></script>
-`) .Site.Params.cdn.popper .Site.Params.cdn.popper_hash .Site.Params.cdn.js .Site.Params.cdn.js_hash) "html" "" }}
+    {{ highlight (printf (`<script src="%s" integrity=%q crossorigin="anonymous"></script>
+<script src="%s" integrity=%q crossorigin="anonymous"></script>
+`) .Site.Params.cdn.popper (.Site.Params.cdn.popper_hash | safeHTMLAttr) .Site.Params.cdn.js (.Site.Params.cdn.js_hash | safeHTMLAttr)) "html" "" }}
   </div>
 </div>
 

diff --git a/site/layouts/partials/scripts.html b/site/layouts/partials/scripts.html
index afe7bd8121b340165df902b68f321e2bbb8537d3..d7c6946417b88384a6d278a252513f1947fe0947 100644 (file)
--- a/site/layouts/partials/scripts.html
+++ b/site/layouts/partials/scripts.html
@@ -1,5 +1,5 @@
 {{ if eq hugo.Environment "production" -}}
-  <script src="/docs/{{ .Site.Params.docs_version }}/dist/js/bootstrap.bundle.min.js" integrity="{{ .Site.Params.cdn.js_bundle_hash }}" crossorigin="anonymous"></script>
+  <script src="/docs/{{ .Site.Params.docs_version }}/dist/js/bootstrap.bundle.min.js" {{ printf "integrity=%q" .Site.Params.cdn.js_bundle_hash | safeHTMLAttr }} crossorigin="anonymous"></script>
 {{ else -}}
   <script src="/docs/{{ .Site.Params.docs_version }}/dist/js/bootstrap.bundle.js"></script>
 {{- end }}

diff --git a/site/layouts/partials/stylesheet.html b/site/layouts/partials/stylesheet.html
index f61c07f7628de7a4ed14b36cf52c425fc3e5ea15..479c5e408c65511aa191cf1e992a1189e4ee0d4f 100644 (file)
--- a/site/layouts/partials/stylesheet.html
+++ b/site/layouts/partials/stylesheet.html
@@ -1,6 +1,6 @@
 {{- "<!-- Bootstrap core CSS -->" | safeHTML }}
 {{ if eq hugo.Environment "production" -}}
-<link href="/docs/{{ .Site.Params.docs_version }}/dist/css/bootstrap.min.css" rel="stylesheet" integrity="{{ .Site.Params.cdn.css_hash }}" crossorigin="anonymous">
+<link href="/docs/{{ .Site.Params.docs_version }}/dist/css/bootstrap.min.css" rel="stylesheet" {{ printf "integrity=%q" .Site.Params.cdn.css_hash | safeHTMLAttr }} crossorigin="anonymous">
 {{- else -}}
 <link href="/docs/{{ .Site.Params.docs_version }}/dist/css/bootstrap.css" rel="stylesheet">
 {{- end }}