Kotlin and Java generics broken

[JorgeCastilloPrz]

This might well be related to highlight.js, but in later versions of reveal, adding this Kotlin code snippet to markdown:

sealed class Either<out A, out B> {
  data class Left<out A>(val a: A) : Either<A, Nothing>()
  data class Right<out B>(val b: B) : Either<Nothing, B>()
}

You see how the printed code gets all generic types broken, understanding those as html tags:

I'd say there's a problem with highlight.js related to this issue on their repo from 2014. The thing is we've been able to write Kotlin and Java code snippets with generic types lately without the need for escaping those characters "manually". It worked for Reveal version 3.9.2.

We can always replace the < / > characters by their html representation < / > to get it fixed, but that is very counterproductive when you need to do it in lots of code snippets across a presentation.

Seems to be related to the RevealHighlight plugin but, maybe I'm missing something here? 🤔 thanks in advance.

Which language seems to have the issue?
kotlin, java

[joshgoebel]

Speaking for HLJS at least this is the correct behavior. Content inside a <code> block MUST be properly escaped. HTML inside <code> is literally actual HTML. There are potentially VERY serious security consequences to anyone highlighting random code and not doing this escaping properly. HTML injection, JS injection, etc...

In a complex system this is really a step that an intermediate parser should handle... such as if you had a blog where content was Markdown with code snippets... the Markdown parser should proper escape HTML inside code snippets as it converts the Markdown content to HTML, etc.

[hakimel]

Thanks for chiming in and for your work on highlight.js @yyyc514 🙌

I just pushed a small update to the reveal.js highlight plugin which lets you avoid code hitting the HTML parser by wrapping it in <script type="text/template">. If you want to include unescaped HTML entities like < and > you can use it like this:

<pre><code><script type="text/template">
sealed class Either<out A, out B> {
  data class Left<out A>(val a: A) : Either<A, Nothing>()
  data class Right<out B>(val b: B) : Either<Nothing, B>()
}
</script></code></pre>

This is only available in the dev branch so far but you can copy the highlight plugin from there if you want to try it out ahead of the next release.

37d8337

[joshgoebel]

The only problem with that is if someone inserts an unescaped closing script tag then they break out of the script element and now you’re opening yourself up to a HTML or JavaScript injection attack all over again.

So if you’re using content provided by the user you need to be very careful which ever way you go here.

<pre><code><script type="text/template">
sealed class Either<out A, out B> {
  data class Left<out A>(val a: A) : Either<A, Nothing>()
  data class Right<out B>(val b: B) : Either<Nothing, B>()
  data class Middle</script>

<!-- do all sorts of EVIL nefarious stuff here -->

<script>
</script></code></pre>