From ea5de270260beff29b450de9f2ff9869786f7607 Mon Sep 17 00:00:00 2001
From: Adam James <atj@pulsewidth.org.uk>
Date: Tue, 20 Dec 2022 17:20:11 +0000
Subject: [PATCH] Escape message passed to gtk_label_set_markup()

Fixes #5
---
 src/ssh-askpass-fullscreen.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/ssh-askpass-fullscreen.c b/src/ssh-askpass-fullscreen.c
index 9683ef4..b58d423 100644
--- a/src/ssh-askpass-fullscreen.c
+++ b/src/ssh-askpass-fullscreen.c
@@ -268,7 +268,7 @@ passphrase_dialog(char *message)
 	GdkPixmap *pixmap;
 	GdkRectangle rect;
 	GdkColor color;
-	gchar *str;
+	gchar *escaped_message, *str;
 	GdkGrabStatus status;
 	int grab_tries = 0;
 	const char *failed;
@@ -367,8 +367,10 @@ passphrase_dialog(char *message)
 
 	gtk_box_pack_start(GTK_BOX(vbox), label, FALSE, FALSE, 12);
 
+	escaped_message = g_markup_escape_text(message, strlen(message));
 	str = g_strdup_printf("<span foreground=\"white\" size=\"xx-large\"><b>%s</b></span>",
-						  message);
+						  escaped_message);
+	g_free(escaped_message);
 	gtk_label_set_markup(GTK_LABEL(label), str);
 	g_free(str);