From a426da534c89a33ff28e6299d690a82ab2fc2081 Mon Sep 17 00:00:00 2001
From: advplyr <advplyr@protonmail.com>
Date: Fri, 5 Jan 2024 14:45:25 -0600
Subject: [PATCH] Fix:Export OPML not escaping characters #2487

---
 server/utils/generators/opmlGenerator.js | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/server/utils/generators/opmlGenerator.js b/server/utils/generators/opmlGenerator.js
index 8cc3f7fb..8fb7c87c 100644
--- a/server/utils/generators/opmlGenerator.js
+++ b/server/utils/generators/opmlGenerator.js
@@ -1,4 +1,5 @@
 const xml = require('../../libs/xml')
+const escapeForXML = require('../../libs/xml/escapeForXML')
 
 /**
  * Generate OPML file string for podcasts in a library
@@ -12,18 +13,18 @@ module.exports.generate = (podcasts, indent = true) => {
     if (!podcast.feedURL) return
     const feedAttributes = {
       type: 'rss',
-      text: podcast.title,
-      title: podcast.title,
-      xmlUrl: podcast.feedURL
+      text: escapeForXML(podcast.title),
+      title: escapeForXML(podcast.title),
+      xmlUrl: escapeForXML(podcast.feedURL)
     }
     if (podcast.description) {
-      feedAttributes.description = podcast.description
+      feedAttributes.description = escapeForXML(podcast.description)
     }
     if (podcast.itunesPageUrl) {
-      feedAttributes.htmlUrl = podcast.itunesPageUrl
+      feedAttributes.htmlUrl = escapeForXML(podcast.itunesPageUrl)
     }
     if (podcast.language) {
-      feedAttributes.language = podcast.language
+      feedAttributes.language = escapeForXML(podcast.language)
     }
     bodyItems.push({
       outline: {