diff --git a/geonode/base/models.py b/geonode/base/models.py
index 88181530054..96fbbb5bc7d 100644
--- a/geonode/base/models.py
+++ b/geonode/base/models.py
@@ -41,6 +41,7 @@
from django.core.files.base import ContentFile
from django.contrib.gis.geos import GEOSGeometry
from django.utils.timezone import now
+from django.utils.html import escape
from mptt.models import MPTTModel, TreeForeignKey
@@ -383,6 +384,7 @@ def add(self, *tags):
tag_objs.update(existing)
for new_tag in str_tags - set(t.name for t in existing):
if new_tag:
+ new_tag = escape(new_tag)
tag_objs.add(HierarchicalKeyword.add_root(name=new_tag))
for tag in tag_objs:
diff --git a/geonode/layers/tests.py b/geonode/layers/tests.py
index a68f5275539..f3535018038 100644
--- a/geonode/layers/tests.py
+++ b/geonode/layers/tests.py
@@ -258,6 +258,17 @@ def test_layer_save(self):
u'here', u'keywords', u'populartag', u'saving',
u'ß', u'ä', u'ö', u'ü', u'論語'])
+ # Test input escape
+ lyr.keywords.add(*["Europe",
+ "land_covering",
+ "Science"])
+
+ self.assertEqual(
+ lyr.keyword_list(), [
+ u'<IMG SRC='javascript:true;'>Science', u'Europe<script>true;</script>',
+ u'here', u'keywords', u'land_<script>true;</script>covering', u'populartag', u'saving',
+ u'ß', u'ä', u'ö', u'ü', u'論語'])
+
self.client.login(username='admin', password='admin')
response = self.client.get(reverse('layer_detail', args=(lyr.alternate,)))
self.failUnlessEqual(response.status_code, 200)
@@ -277,7 +288,13 @@ def test_layer_save(self):
{"text": u"ä", "href": "a", "id": 10},
{"text": u"ö", "href": "o", "id": 7},
{"text": u"ü", "href": "u", "id": 8},
- {"text": u"論語", "href": "lun-yu", "id": 6}
+ {"text": u"論語", "href": "lun-yu", "id": 6},
+ {"text": u"Europe<script>true;</script>",
+ "href": "u'europeltscriptgttrueltscriptgt", "id": 12},
+ {"text": u"land_<script>true;</script>covering",
+ "href": "u'land_ltscriptgttrueltscriptgtcovering", "id": 13},
+ {"text": u"<IMGSRC='javascript:true;'>Science",
+ "href": "u'ltimgsrc39javascripttrue39gtscience", "id": 11},
]))
def test_layer_links(self):
diff --git a/geonode/services/templates/services/service_detail.html b/geonode/services/templates/services/service_detail.html
index b2bf0d48e2b..4c60bbeefac 100644
--- a/geonode/services/templates/services/service_detail.html
+++ b/geonode/services/templates/services/service_detail.html
@@ -41,15 +41,15 @@