lib/onebox/engine/audio_onebox.rb in onebox-1.7.3 vs lib/onebox/engine/audio_onebox.rb in onebox-1.7.4

@@ -8,11 +8,17 @@
       def always_https?
         WhitelistedGenericOnebox.host_matches(uri, WhitelistedGenericOnebox.https_hosts)
       end
 
       def to_html
-        url = ::Onebox::Helpers.normalize_url_for_output(@url)
-        "<audio controls><source src='#{url}'><a href='#{url}'>#{url}</a></audio>"
+        escaped_url = ::Onebox::Helpers.normalize_url_for_output(@url)
+
+        <<-HTML
+          <audio controls>
+            <source src="#{escaped_url}">
+            <a href="#{escaped_url}">#{@url}</a>
+          </audio>
+        HTML
       end
     end
   end
 end