Ticket #17562: 17562.the-permalink-escape-output.diff

wp-includes/link-template.php

@@ -13 +13 @@
  * @uses apply_filters() Calls 'the_permalink' filter on the permalink string.
  */
 function the_permalink() {
-        echo apply_filters('the_permalink', get_permalink());
+        echo esc_url( apply_filters( 'the_permalink', get_permalink() ) );
 }
 
 /**