prevent xss for app title

lib/util/swigFunctions.js

@@ -1,6 +1,7 @@
 module.exports = function(crowi, app, req, locals) {
   const debug = require('debug')('growi:lib:swigFunctions')
     , stringWidth = require('string-width')
+    , entities = require('entities')
     , Page = crowi.model('Page')
     , Config = crowi.model('Config')
     , User = crowi.model('User')
@@ -45,8 +46,8 @@ module.exports = function(crowi, app, req, locals) {
    * return app title
    */
   locals.appTitle = function() {
-    var config = crowi.getConfig();
-    return Config.appTitle(config);
+    const config = crowi.getConfig();
+    return entities.encodeHTML(Config.appTitle(config));
   };
 
   /**