From 61914d56c64761beb770eb25d3e3d3f1db07f138 Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.helbling@determinate.systems>
Date: Fri, 28 Jan 2022 09:39:51 -0800
Subject: [PATCH] runcommand-log.tt: escape the command

---
 src/root/runcommand-log.tt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/root/runcommand-log.tt b/src/root/runcommand-log.tt
index 7d346823..b937a373 100644
--- a/src/root/runcommand-log.tt
+++ b/src/root/runcommand-log.tt
@@ -11,7 +11,7 @@
   [% ELSE %]
   is
   [% END %]
-  the output of a RunCommand execution of the command <tt>[% runcommandlog.command %]</tt>
+  the output of a RunCommand execution of the command <tt>[% HTML.escape(runcommandlog.command) %]</tt>
   on <a href="[% c.uri_for('/build', build.id) %]">Build [% build.id %]</a>.
   [% IF tail %]
   The <a href="[% c.uri_for('/build', build.id, 'runcommandlog', runcommandlog.uuid) %]">full log</a> is also available.