|
@@ -116,6 +116,26 @@ md.renderer.rules.image = function (tokens, idx, options, env, self) {
|
|
return self.renderToken(tokens, idx, options);
|
|
return self.renderToken(tokens, idx, options);
|
|
};
|
|
};
|
|
|
|
|
|
|
|
+var HTML_ESCAPE_TEST_RE = /[&<>"]/;
|
|
|
|
+var HTML_ESCAPE_REPLACE_RE = /[&<>"]/g;
|
|
|
|
+var HTML_REPLACEMENTS = {
|
|
|
|
+ '&': '&',
|
|
|
|
+ '<': '<',
|
|
|
|
+ '>': '>',
|
|
|
|
+ '"': '"'
|
|
|
|
+};
|
|
|
|
+
|
|
|
|
+function replaceUnsafeChar(ch) {
|
|
|
|
+ return HTML_REPLACEMENTS[ch];
|
|
|
|
+}
|
|
|
|
+
|
|
|
|
+function escapeHtml(str) {
|
|
|
|
+ if (HTML_ESCAPE_TEST_RE.test(str)) {
|
|
|
|
+ return str.replace(HTML_ESCAPE_REPLACE_RE, replaceUnsafeChar);
|
|
|
|
+ }
|
|
|
|
+ return str;
|
|
|
|
+}
|
|
|
|
+
|
|
// Fence code blocks
|
|
// Fence code blocks
|
|
md.renderer.rules.fence = function (tokens, idx, options, env, self) {
|
|
md.renderer.rules.fence = function (tokens, idx, options, env, self) {
|
|
var token = tokens[idx],
|
|
var token = tokens[idx],
|
|
@@ -128,9 +148,9 @@ md.renderer.rules.fence = function (tokens, idx, options, env, self) {
|
|
}
|
|
}
|
|
|
|
|
|
if (options.highlight) {
|
|
if (options.highlight) {
|
|
- highlighted = options.highlight(token.content, langName) || encodeURI(token.content);
|
|
|
|
|
|
+ highlighted = options.highlight(token.content, langName) || escapeHtml(token.content);
|
|
} else {
|
|
} else {
|
|
- highlighted = encodeURI(token.content);
|
|
|
|
|
|
+ highlighted = escapeHtml(token.content);
|
|
}
|
|
}
|
|
|
|
|
|
if (highlighted.indexOf('<pre') === 0) {
|
|
if (highlighted.indexOf('<pre') === 0) {
|
|
@@ -163,7 +183,6 @@ md.renderer.rules.fence = function (tokens, idx, options, env, self) {
|
|
+ '</code>' + copy + '</pre>\n';
|
|
+ '</code>' + copy + '</pre>\n';
|
|
}
|
|
}
|
|
|
|
|
|
-
|
|
|
|
return '<pre>' + '<code id="' + id +'"' + self.renderAttrs(token) + '>'
|
|
return '<pre>' + '<code id="' + id +'"' + self.renderAttrs(token) + '>'
|
|
+ highlighted
|
|
+ highlighted
|
|
+ '</code>' + copy + '</pre>\n';
|
|
+ '</code>' + copy + '</pre>\n';
|