ensure HTML-safety of attributes; only-whitespace values treated as unpopulated

2 files changed, 10 insertions, 8 deletions

diff --git a/rebuild.py b/rebuild.py
index 55b0d50..90103b2 100755
--- a/rebuild.py
+++ b/rebuild.py
@@ -65,17 +65,19 @@ def get_books(root_path):
             attr = dict()
             attr['path'] = file_path
             attr['duration'] = tag.duration
-            if tag.title:
+            if tag.title and not tag.title.isspace():
                 attr['title'] = tag.title
             else:
-                attr['title'] = file_path.split('/')[-1]
-            if tag.album:
+                attr['title'] = os.path.split(file_path)[1]
+
+            if tag.album and not tag.album.isspace():
                 attr['album'] = tag.album
                 book['title'] = tag.album
             else:
-                attr['album'] = book_path.split('/')[-1]
-                book['title'] = book_path.split('/')[-1]
-            if tag.artist:
+                attr['album'] = os.path.split(book_path)[1]
+                book['title'] = os.path.split(book_path)[1]
+
+            if tag.artist and not tag.artist.isspace():
                 attr['author'] = tag.artist
                 book['author'] = tag.artist
             else:
diff --git a/templates/index.html b/templates/index.html
index 7bee424..9bf35db 100644
--- a/templates/index.html
+++ b/templates/index.html
@@ -33,8 +33,8 @@
         </tr>
         {% for b, v in books.items() %}
         <tr>
-            <td><a href="?a={{ b }}">{{ v['title'] }}</a></td>
-            <td>{{ v['path'] }}</td>
+            <td><a href="?a={{ b }}">{{ v['title']|escape }}</a></td>
+            <td>{{ v['path']|escape }}</td>
             <td>{{ v['files']|length }}</td>
             <td>{{ v['duration_str'] }}</td>
             <td>{{ v['size_str'] }}</td>