From 34f5512407db463dd7f574c3ee7e113cb3f075b6 Mon Sep 17 00:00:00 2001
From: Ian Gulliver <ian@isinglasstheater.org>
Date: Wed, 2 Jul 2014 13:33:20 -0700
Subject: [PATCH] Python: escaping, fix in filter

---
 recentrunes.py | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/recentrunes.py b/recentrunes.py
index d0a5766..77ef877 100644
--- a/recentrunes.py
+++ b/recentrunes.py
@@ -16,10 +16,12 @@ class TextNode(object):
   def cloneNode(self, deep):
     return TextNode(self.textContent)
 
-  def __str__(self):
-    # TODO: HTML escaping
+  def getTextContent(self):
     return self.textContent
 
+  def __str__(self):
+    return self.textContent.replace('&', '&amp;').replace('<', '&lt;')
+
 
 class Element(object):
   def __init__(self, nodeName):
@@ -81,10 +83,18 @@ class Element(object):
       element.setAttribute(key, value)
     return element
 
+  def getTextContent(self):
+    return ''.join(x.getTextContent() for x in self.childNodes)
+
   def __str__(self):
     # TODO: attributes
     values = map(str, self.childNodes)
-    return '<%s>%s</%s>' % (self.nodeName, ''.join(values), self.nodeName)
+    return '<%s%s>%s</%s>' % (
+        self.nodeName,
+        ''.join(' %s="%s"' % (k, v.replace('"', '&quot;'))
+                              for k, v in self.attributes.iteritems()),
+        ''.join(values),
+        self.nodeName)
 
 
 # ============ Matchers ============
@@ -277,7 +287,7 @@ def ChildToAttribute(parentName, childName):
       return
     for childNode in node.childNodes:
       if childNode.nodeName == childName:
-        node.setAttribute(childName, childNode.textContent)
+        node.setAttribute(childName, childNode.getTextContent())
         node.removeChild(childNode)
         break
   return Filter