From 0e8b4b8342ceaadf3a669bef2d53d8ea3a2cb116 Mon Sep 17 00:00:00 2001
From: Mads Krohn <sniffdk@gmail.com>
Date: Mon, 2 Sep 2019 08:46:33 +0200
Subject: [PATCH] Correctly html encode text (#6235)

(cherry picked from commit 1bf85ab1dbfd5824c4a295cf89c21ebe87132208)
---
 src/Umbraco.Web/HtmlStringUtilities.cs | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/src/Umbraco.Web/HtmlStringUtilities.cs b/src/Umbraco.Web/HtmlStringUtilities.cs
index 6cf5092bb0..4606a58a3a 100644
--- a/src/Umbraco.Web/HtmlStringUtilities.cs
+++ b/src/Umbraco.Web/HtmlStringUtilities.cs
@@ -19,10 +19,26 @@ namespace Umbraco.Web
         /// Replaces text line breaks with HTML line breaks
         /// </summary>
         /// <param name="text">The text.</param>
-        /// <returns>The text with text line breaks replaced with HTML line breaks (<br/>)</returns>
+        /// <returns>The text with text line breaks replaced with HTML line breaks (<c>&lt;br /&gt;</c>).
+        [Obsolete("This method doesn't HTML encode the text. Use ReplaceLineBreaks instead.")]
         public HtmlString ReplaceLineBreaksForHtml(string text)
         {
-            return new HtmlString(text.Replace("\r\n", @"<br />").Replace("\n", @"<br />").Replace("\r", @"<br />"));
+            return new HtmlString(text.Replace("\r\n", @"<br />").Replace("\n", @"<br />").Replace("\r", @"<br />"));            
+        }
+        
+        /// <summary>
+        /// HTML encodes the text and replaces text line breaks with HTML line breaks.
+        /// </summary>
+        /// <param name="text">The text.</param>
+        /// <returns>The HTML encoded text with text line breaks replaced with HTML line breaks (<c>&lt;br /&gt;</c>).</returns>
+        public IHtmlString ReplaceLineBreaks(string text)
+        {
+            var value = HttpUtility.HtmlEncode(text)?
+                .Replace("\r\n", "<br />")
+                .Replace("\r", "<br />")
+                .Replace("\n", "<br />");
+
+            return new HtmlString(value);
         }
 
         public HtmlString StripHtmlTags(string html, params string[] tags)