fix: escape html string @ inline code

nextcloud · Apr 21, 2024 · ae8caa6 · ae8caa6
1 parent faf0918
commit ae8caa6
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/src/components/EditorMarkdownIt.vue b/src/components/EditorMarkdownIt.vue
@@ -148,10 +148,17 @@ export default {
 			}
 		},
 
+		escapeHTML(string) {
+			return string.replace(/[^\u0030-\u0039\u0041-\u005A\u0061-\u007A]/g, function(char) {
+				return `&#${char.charCodeAt()}`
+			})
+		},
+
 		setInlineCodeRule() {
+			const editorInstance = this
 			this.md.renderer.rules.code_inline = function(tokens, idx, options, env, self) {
 				const token = tokens[idx]
-				return '<code class="inline-code">' + token.content + '</code>'
+				return '<code class="inline-code">' + editorInstance.escapeHTML(token.content) + '</code>'
 			}
 		},
 	},