compareVersions responder content not HTML escaped

[cedclement]

Hello,
The compareVersions responder generates invalid HTML, because the pages content is not escaped.

[amolenaar]

Hi,

Can you provide an example? That would really help in narrowing the issue.

[cedclement]

Yes sure !
For instance, if the content.txt contains a backward search reference link such as <AncestorPage.SomePage, then the diff is truncated before <AncestorPage.SomePage and the browser complains about a missing closing tag.
Looking at the generated html, I can see that the content is not HTML escaped :

<table class="diff_table">   
  <tr>
    <td class="diff_line diff_chunk_header">--- 71b8e94e0f142ecadd0e36f7cfd832d4b058ce49</td>
  </tr>
  <tr>
    <td class="diff_line diff_chunk_header">+++ 88b0eb625fa81a7d1158a588fb86a7b0cb003136</td>
  </tr>
  <tr>
    <td class="diff_line diff_chunk_header">@@ -1,2 +1,2 @@</td>
  </tr>
  <tr>
    <td class="diff_line">Some content</td>
  </tr>
  <tr>
    <td class="diff_line diff_line_removed">-Try a link to <AncestorPage.SomePage </td>
  </tr>
  <tr>
    <td class="diff_line diff_line_added">+Try a link to <AncestorPage.SomePage with more content </td>
  </tr>
</table>

[amolenaar]

Fixed by #869.