Escape!

app/helpers/events_helper.rb

@@ -3,7 +3,7 @@ module EventsHelper
     author = event.author
 
     if author
-      link_to author.name, user_path(author.username), title: author.name
+      link_to author.name, user_path(author.username), title: h(author.name)
     else
       event.author_name
     end
@@ -159,7 +159,7 @@ module EventsHelper
         link_to(
           namespace_project_commit_path(event.project.namespace, event.project,
                                         event.note_commit_id,
-                                        anchor: dom_id(event.target), title: event.target_title),
+                                        anchor: dom_id(event.target), title: h(event.target_title)),
           class: "commit_short_id"
         ) do
           "#{event.note_target_type} #{event.note_short_commit_id}"
@@ -167,11 +167,11 @@ module EventsHelper
       elsif event.note_project_snippet?
         link_to(namespace_project_snippet_path(event.project.namespace,
                                                event.project,
-                                               event.note_target), title: event.project.name) do
+                                               event.note_target), title: h(event.project.name)) do
           "#{event.note_target_type} #{truncate event.note_target.to_reference}"
         end
       else
-        link_to event_note_target_path(event), title: event.note_target.to_reference do
+        link_to event_note_target_path(event), title: h(event.note_target.to_reference) do
           "#{event.note_target_type} #{truncate event.note_target.to_reference}"
         end
       end

app/helpers/projects_helper.rb

@@ -8,7 +8,7 @@ module ProjectsHelper
   end
 
   def link_to_project(project)
-    link_to [project.namespace.becomes(Namespace), project], title: project.name do
+    link_to [project.namespace.becomes(Namespace), project], title: h(project.name) do
       title = content_tag(:span, project.name, class: 'project-name')
 
       if project.namespace

app/views/events/_event_last_push.html.haml

@@ -3,7 +3,7 @@
     .event-last-push
       .event-last-push-text
         %span You pushed to
-        = link_to namespace_project_commits_path(event.project.namespace, event.project, event.ref_name), title: event.project.name do
+        = link_to namespace_project_commits_path(event.project.namespace, event.project, event.ref_name), title: h(event.project.name) do
           %strong= event.ref_name
         %span at
         %strong= link_to_project event.project

app/views/events/event/_common.html.haml

@@ -4,7 +4,7 @@
     = event_action_name(event)
 
   - if event.target
-    %strong= link_to event.target.to_reference, [event.project.namespace.becomes(Namespace), event.project, event.target], title: event.target.to_reference
+    %strong= link_to event.target.to_reference, [event.project.namespace.becomes(Namespace), event.project, event.target]
 
   = event_preposition(event)
 

app/views/events/event/_push.html.haml

@@ -5,7 +5,7 @@
     %strong= event.ref_name
   - else
     %strong
-      = link_to event.ref_name, namespace_project_commits_path(event.project.namespace, event.project, event.ref_name), title: event.target_title
+      = link_to event.ref_name, namespace_project_commits_path(event.project.namespace, event.project, event.ref_name), title: h(event.target_title)
   at
   = link_to_project event.project