Escape failed highlighted code (#12685)

Signed-off-by: Andrew Thornton <art27@cantab.net>
2020-09-02 21:19:42 +01:00 · 2020-09-02 21:19:42 +01:00 · dead2a9b2d
commit dead2a9b2d
parent 72eeb13e4d
1 changed files with 2 additions and 1 deletions
--- a/modules/highlight/highlight.go
+++ b/modules/highlight/highlight.go
@ -8,6 +8,7 @@ package highlight
 import (
 	"bufio"
 	"bytes"
+	gohtml "html"
 	"path/filepath"
 	"strings"
 	"sync"
@ -160,7 +161,7 @@ func plainText(code string, numLines int) map[int]string {
 		if content == "" {
 			content = "\n"
 		}
-		m[line] = content
+		m[line] = gohtml.EscapeString(content)
 	}
 	return m
 }