From 7b84d8f04a7efedf20e1a9eabdc97d85d162d13d Mon Sep 17 00:00:00 2001
From: rudolfkoenig <>
Date: Wed, 23 Mar 2022 11:28:24 +0000
Subject: [PATCH] 98_SVG.pm: escape special characters in labels (Forum
 #126905)

git-svn-id: https://svn.fhem.de/fhem/trunk@25876 2b470e98-0d58-463d-a4d8-8e2adae1ed80
---
 fhem/FHEM/98_SVG.pm | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/fhem/FHEM/98_SVG.pm b/fhem/FHEM/98_SVG.pm
index 937bd308b..6997ccad3 100644
--- a/fhem/FHEM/98_SVG.pm
+++ b/fhem/FHEM/98_SVG.pm
@@ -1392,6 +1392,17 @@ SVG_getSteps($$$)
   return ($step, $mi, $ma);
 }
 
+sub
+SVG_escape($)
+{
+  my ($txt) = @_;
+  $txt =~ s/&/&amp;/g;
+  $txt =~ s/</&lt;/g;
+  $txt =~ s/>/&gt;/g;
+  $txt =~ s/'/&apos;/g;
+  return $txt;
+}
+
 sub
 SVG_render($$$$$$$$$$)
 {
@@ -1489,9 +1500,7 @@ SVG_render($$$$$$$$$$)
         "fill='none' class='border'/>";
 
   my ($off1,$off2) = ($x+$w/2, 3*$y/4);
-  my $title = ($conf{title} ? $conf{title} : " ");
-  $title =~ s/</&lt;/g;
-  $title =~ s/>/&gt;/g;
+  my $title = SVG_escape($conf{title} ? $conf{title} : " ");
   SVG_pO "<text id='svg_title' x='$off1' y='$off2' " .
         "class='title' text-anchor='middle'>$title</text>";
 
@@ -2247,6 +2256,7 @@ SVG_render($$$$$$$$$$)
     }
     my $style = $conf{lStyle}[$i];
     $style =~ s/class="/class="legend /;
+    $desc = SVG_escape($desc);
     SVG_pO "<text line_id=\"line_$i\" x=\"$txtoff1\" y=\"$txtoff2\" ".
         "text-anchor=\"$caption_anchor\" $style>$t<title>$desc</title></text>";