Merge pull request #1209 from blake-regalia/fix/rdf2dot-ampersand-escape

rd2dot Escape HTML in node label and URI text
RDFLib · Dec 27, 2020 · b557dca · b557dca
2 parents 43cc004 + 1ee96eb
commit b557dca
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rdflib/tools/rdf2dot.py b/rdflib/tools/rdf2dot.py
@@ -153,7 +153,7 @@ def color(p):
             + "<font point-size='10' color='#6666ff'>%s</font></td>"
             + "</tr>%s</table> > ] \n"
         )
-        stream.write(opstr % (n, NODECOLOR, label(u, g), u, u, "".join(f)))
+        stream.write(opstr % (n, NODECOLOR, html.escape(label(u, g)), u, html.escape(u), "".join(f)))
 
     stream.write("}\n")