From 9e90c16950677079a1486c90ffbffe47e98dc67a Mon Sep 17 00:00:00 2001
From: Alex O'Ree <alexoree@apache.org>
Date: Fri, 28 Aug 2026 15:13:18 -0400
Subject: [PATCH] JSPWIKI-1281 see jira for details

---
 .../java/org/apache/wiki/plugin/WeblogPlugin.java   |  2 +-
 .../org/apache/wiki/plugin/WeblogPluginTest.java    | 13 +++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/jspwiki-main/src/main/java/org/apache/wiki/plugin/WeblogPlugin.java b/jspwiki-main/src/main/java/org/apache/wiki/plugin/WeblogPlugin.java
index af882aee71..3979b6f39b 100644
--- a/jspwiki-main/src/main/java/org/apache/wiki/plugin/WeblogPlugin.java
+++ b/jspwiki-main/src/main/java/org/apache/wiki/plugin/WeblogPlugin.java
@@ -304,7 +304,7 @@ private void addEntryHTML( final Context context, final DateFormat entryFormat,
         buffer.append("<div class=\"weblogentryheading\">\n");
 
         final Date entryDate = entry.getLastModified();
-        buffer.append( entryFormat != null ? entryFormat.format(entryDate) : entryDate );
+        buffer.append( entryFormat != null ? TextUtil.replaceEntities( entryFormat.format(entryDate) ) : entryDate );
         buffer.append("</div>\n");
 
         //
diff --git a/jspwiki-main/src/test/java/org/apache/wiki/plugin/WeblogPluginTest.java b/jspwiki-main/src/test/java/org/apache/wiki/plugin/WeblogPluginTest.java
index 01d53bcc75..02ad4cb6de 100644
--- a/jspwiki-main/src/test/java/org/apache/wiki/plugin/WeblogPluginTest.java
+++ b/jspwiki-main/src/test/java/org/apache/wiki/plugin/WeblogPluginTest.java
@@ -82,4 +82,17 @@ public void testWeblogEntriesWithPreviewAndTrimming() throws WikiException {
         Assertions.assertTrue( res.contains( "<div class=\"weblogentrybody\">\nAnother blog entry  <a href=\"/test/Wiki.jsp?page="+ blogEntryPage + "\">(more)</a>\n</div>\n" ), res );
     }
 
+    @Test
+    public void testEntryFormatIsEscaped() throws WikiException {
+        final WeblogEntryPlugin wep = new WeblogEntryPlugin();
+        testEngine.saveText( wep.getNewEntryPage( testEngine, "Test5" ), "Blog entry" );
+        // A SimpleDateFormat quoted literal in an author-supplied entryFormat must not be emitted as raw markup.
+        final String src = "[{WeblogPlugin days='90' entryFormat=\"'<script>alert(document.cookie)</script>'\"}]";
+        testEngine.saveText( "Test5", src );
+
+        final String res = testEngine.getI18nHTML( "Test5" );
+        Assertions.assertFalse( res.contains( "<script>" ), res );
+        Assertions.assertFalse( res.contains( "<script>alert(document.cookie)</script>" ), res );
+    }
+
 }