Fix link replacer to properly escape special HTML characters.

pelican/contents.py

@@ -2,6 +2,7 @@
 from __future__ import print_function, unicode_literals
 
 import copy
+import html
 import locale
 import logging
 import os
@@ -230,9 +231,9 @@ def get_url_setting(self, key):
 
     def _link_replacer(self, siteurl, m):
         what = m.group('what')
-        value = urlparse(m.group('value'))
+        value = urlparse(html.unescape(m.group('value')))
         path = value.path
-        origin = m.group('path')
+        origin = html.unescape(m.group('path'))
 
         # XXX Put this in a different location.
         if what in {'filename', 'attach'}:
@@ -285,7 +286,7 @@ def _link_replacer(self, siteurl, m):
         # keep all other parts, such as query, fragment, etc.
         parts = list(value)
         parts[2] = origin
-        origin = urlunparse(parts)
+        origin = html.escape(urlunparse(parts))
 
         return ''.join((m.group('markup'), m.group('quote'), origin,
                         m.group('quote')))