Merge pull request #325 from campersau/escape_header

escape diff headers for html
rtfpessoa · Jun 30, 2020 · 8462e52 · 8462e52
2 parents 12bf306 + 406be9f
commit 8462e52
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/src/__tests__/diff2html-tests.ts b/src/__tests__/diff2html-tests.ts
@@ -723,7 +723,7 @@ describe('Diff2Html', () => {
 <tr>
     <td class=\\"d2h-code-linenumber d2h-info\\"></td>
     <td class=\\"d2h-info\\">
-        <div class=\\"d2h-code-line d2h-info\\">@@ -11,7 +10,7 @@ $a=&quot;&lt;table&gt;&lt;tr&gt;&lt;td&gt;- 1.1.9: Fix around ubuntu&#x27;s inability to cache promises. [#8</div>
+        <div class=\\"d2h-code-line d2h-info\\">@@ -11,7 +10,7 @@ $a=&amp;quot;&amp;lt;table&amp;gt;&amp;lt;tr&amp;gt;&amp;lt;td&amp;gt;- 1.1.9: Fix around ubuntu&amp;#x27;s inability to cache promises. [#8</div>
     </td>
 </tr><tr>
     <td class=\\"d2h-code-linenumber d2h-cntx\\">

diff --git a/src/line-by-line-renderer.ts b/src/line-by-line-renderer.ts
@@ -95,7 +95,7 @@ export default class LineByLineRenderer {
       .map(block => {
         let lines = this.hoganUtils.render(genericTemplatesPath, 'block-header', {
           CSSLineClass: renderUtils.CSSLineClass,
-          blockHeader: block.header,
+          blockHeader: renderUtils.escapeForHtml(block.header),
           lineClass: 'd2h-code-linenumber',
           contentClass: 'd2h-code-line',
         });

diff --git a/src/side-by-side-renderer.ts b/src/side-by-side-renderer.ts
@@ -206,7 +206,7 @@ export default class SideBySideRenderer {
   makeHeaderHtml(blockHeader: string): string {
     return this.hoganUtils.render(genericTemplatesPath, 'block-header', {
       CSSLineClass: renderUtils.CSSLineClass,
-      blockHeader: blockHeader,
+      blockHeader: renderUtils.escapeForHtml(blockHeader),
       lineClass: 'd2h-code-side-linenumber',
       contentClass: 'd2h-code-side-line',
     });