Fix made in November now absent from code

[minusworld]

Hello,

I'm a security researcher at r2c. 👋 I am studying XSS vulnerabilities and happened across this PR addressing an XSS in your repo.

By pure luck, I noticed that the recent refactoring seems to have removed this patch. I'm not certain if this was intentional for some unknown reason; however, I wanted to bring it to your attention.

Hope this helps! Cheers.

[valeriangalliat]

Hey!

We decided that escaping the special characters at the output level with md.utils.escapeHtml(lang) (

markdown-it-highlightjs/core.js

Line 50 in 2c93df7

const cls = lang ? ` class="${options.langPrefix}${md.utils.escapeHtml(lang)}"` : ''

) was a cleaner way to prevent the XSS vulnerability, so the original patch in the regex wasn't necessary anymore :)

If you agree that this is a solid mitigation, I'll let you close this issue, otherwise I would love to hear your thoughts on a better solution.

Cheers!