fix: escape code blocks to prevent HTML injection

2022-12-28 22:18:18 -05:00
parent 8f9091fb2a
commit 5bd9ce484f
2 changed files with 2 additions and 2 deletions
--- a/src/utils/syntax.go
+++ b/src/utils/syntax.go
@ -17,7 +17,7 @@ var plainFormattedCodeRegex = regexp.MustCompile(`(?s)<pre tabindex="0" class="c
 func HighlightSyntaxViaContent(content string) (htmlOut string) {
 	content = html.UnescapeString(content)

-	fallbackOut := content
+	fallbackOut := html.EscapeString(content)

 	// identify the language
 	lexer := lexers.Analyse(content)