properly encode xmltv fragments (#1597)

ErsatzTV.Application/Channels/Commands/RefreshChannelDataHandler.cs

@@ -13,6 +13,7 @@ using Microsoft.Extensions.Logging;
 using Microsoft.IO;
 using Newtonsoft.Json;
 using Scriban;
+using Scriban.Runtime;
 using WebMarkupMin.Core;
 
 namespace ErsatzTV.Application.Channels;
@@ -55,6 +56,8 @@ public class RefreshChannelDataHandler : IRequestHandler<RefreshChannelData>
                 CollapseTagsWithoutContent = true
             });
 
+        var templateContext = new XmlTemplateContext();
+        
         string movieText = await File.ReadAllTextAsync(movieTemplateFileName, cancellationToken);
         var movieTemplate = Template.Parse(movieText, movieTemplateFileName);
 
@@ -213,8 +216,7 @@ public class RefreshChannelDataHandler : IRequestHandler<RefreshChannelData>
                         .HeadOrNone()
                         .Match(a => GetArtworkUrl(a, ArtworkKind.Poster), () => string.Empty);
 
-                    string result = await movieTemplate.RenderAsync(
-                        new
+                    var data = new
                     {
                         ProgrammeStart = start,
                         ProgrammeStop = stop,
@@ -232,7 +234,13 @@ public class RefreshChannelDataHandler : IRequestHandler<RefreshChannelData>
                         MovieHasContentRating = !string.IsNullOrWhiteSpace(metadata.ContentRating),
                         MovieContentRating = metadata.ContentRating,
                         MovieGuids = metadata.Guids.Map(g => g.Guid)
-                        });
+                    };
+
+                    var scriptObject = new ScriptObject();
+                    scriptObject.Import(data);
+                    templateContext.PushGlobal(scriptObject);
+
+                    string result = await movieTemplate.RenderAsync(templateContext);
 
                     MarkupMinificationResult minified = minifier.Minify(result);
                     await xml.WriteRawAsync(minified.MinifiedContent);
@@ -257,8 +265,7 @@ public class RefreshChannelDataHandler : IRequestHandler<RefreshChannelData>
 
                         string artworkPath = GetPrioritizedArtworkPath(metadata);
 
-                        string result = await episodeTemplate.RenderAsync(
-                            new
+                        var data = new
                         {
                             ProgrammeStart = start,
                             ProgrammeStop = stop,
@@ -281,7 +288,13 @@ public class RefreshChannelDataHandler : IRequestHandler<RefreshChannelData>
                             ShowContentRating = showMetadata.ContentRating,
                             ShowGuids = showMetadata.Guids.Map(g => g.Guid),
                             EpisodeGuids = metadata.Guids.Map(g => g.Guid)
-                            });
+                        };
+                        
+                        var scriptObject = new ScriptObject();
+                        scriptObject.Import(data);
+                        templateContext.PushGlobal(scriptObject);
+
+                        string result = await episodeTemplate.RenderAsync(templateContext);
 
                         MarkupMinificationResult minified = minifier.Minify(result);
                         await xml.WriteRawAsync(minified.MinifiedContent);

ErsatzTV.Application/Channels/Commands/RefreshChannelListHandler.cs

@@ -8,6 +8,7 @@ using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Microsoft.IO;
 using Scriban;
+using Scriban.Runtime;
 using WebMarkupMin.Core;
 
 namespace ErsatzTV.Application.Channels;
@@ -65,6 +66,7 @@ public class RefreshChannelListHandler : IRequestHandler<RefreshChannelList>
         
         string text = await File.ReadAllTextAsync(templateFileName, cancellationToken);
         var template = Template.Parse(text, templateFileName);
+        var templateContext = new XmlTemplateContext();
         
         await using RecyclableMemoryStream ms = _recyclableMemoryStreamManager.GetStream();
         await using var xml = XmlWriter.Create(
@@ -73,15 +75,20 @@ public class RefreshChannelListHandler : IRequestHandler<RefreshChannelList>
 
         await foreach (ChannelResult channel in GetChannels(dbContext).WithCancellation(cancellationToken))
         {
-            string result = await template.RenderAsync(
-                new
+            var data = new
             {
                 ChannelNumber = channel.Number,
                 ChannelName = channel.Name,
                 ChannelCategories = GetCategories(channel.Categories),
                 ChannelHasArtwork = !string.IsNullOrWhiteSpace(channel.ArtworkPath),
                 ChannelArtworkPath = channel.ArtworkPath
-                });
+            };
+            
+            var scriptObject = new ScriptObject();
+            scriptObject.Import(data);
+            templateContext.PushGlobal(scriptObject);
+
+            string result = await template.RenderAsync(templateContext);
 
             MarkupMinificationResult minified = minifier.Minify(result);
             await xml.WriteRawAsync(minified.MinifiedContent);

ErsatzTV.Application/Channels/XmlTemplateContext.cs

@@ -0,0 +1,14 @@
+using System.Net;
+using Scriban;
+using Scriban.Parsing;
+
+namespace ErsatzTV.Application.Channels;
+
+public class XmlTemplateContext : TemplateContext
+{
+    public override TemplateContext Write(SourceSpan span, object textAsObject)
+        => base.Write(span, textAsObject is string text ? WebUtility.HtmlEncode(text) : textAsObject);
+
+    public override ValueTask<TemplateContext> WriteAsync(SourceSpan span, object textAsObject)
+        => base.WriteAsync(span, textAsObject is string text ? WebUtility.HtmlEncode(text) : textAsObject);
+}