monitor: Escape root title when generating OPML

/reviewed-on nexedi/slapos.toolbox!34

slapos/monitor/monitor.py

@@ -13,6 +13,7 @@ import ssl
 import glob
 import socket
 from datetime import datetime
+from xml.sax.saxutils import escape
 
 OPML_START = """<?xml version="1.0" encoding="UTF-8"?>
 <!-- OPML generated by SlapOS -->
@@ -284,7 +285,7 @@ class Monitoring(object):
     opml_content = OPML_START % {'creation_date': creation_date,
                                   'modification_date': modification_date,
                                   'outline_title': 'Monitoring RSS Feed list',
-                                  'root_title': self.root_title}
+                                  'root_title': escape(self.root_title)}
 
     opml_content += OPML_OUTLINE_FEED % {'title': self.title,
         'html_url': self.public_url + '/feed',