Improve runkit tag's sanitization (#1798)

app/liquid_tags/runkit_tag.rb

@@ -1,7 +1,7 @@
 class RunkitTag < Liquid::Block
   def initialize(tag_name, markup, tokens)
     super
-    @preamble = ActionView::Base.full_sanitizer.sanitize(markup, tags: [])
+    @preamble = sanitized_preamble(markup)
   end
 
   def render(context)
@@ -64,6 +64,16 @@ def self.script
       }, 200);
     JAVASCRIPT
   end
+
+  def sanitized_preamble(markup)
+    raise StandardError, "Runkit tag is invalid" if markup.ends_with? "\">"
+
+    sanitized = ActionView::Base.full_sanitizer.sanitize(markup, tags: [])
+
+    raise StandardError, "Runkit tag is invalid" if markup.starts_with? "\""
+
+    sanitized
+  end
 end
 
 Liquid::Template.register_tag("runkit", RunkitTag)