escape XML error messages

to avoid any snippets being interpreted as HTML and displayed
numbas · Aug 24, 2022 · f699270 · f699270
1 parent d5877fa
commit f699270
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/runtime/scripts/xml.js b/runtime/scripts/xml.js
@@ -64,7 +64,7 @@ var xml = Numbas.xml = {
         //check for errors
         if(Sarissa.getParseErrorText(doc) != Sarissa.PARSED_OK)
         {
-            throw(new Numbas.Error('xml.could not load',{message:Sarissa.getParseErrorText(doc)}));
+            throw(new Numbas.Error('xml.could not load',{message: Numbas.util.escapeHTML(Sarissa.getParseErrorText(doc))}));
         }
         //allow XPath to be used to select nodes
         doc.setProperty('SelectionLanguage','XPath');