fix: escape invalid lang characters (XSS)

[ooooooo-q]

I found XSS in inline code highlighting.

Example

`console.log(42)`{."><img onerror=alert(1) src=.>js}

Results

<p><code class="language-"><img onerror=alert(1) src=.>js"></code></p>

Similar problem: jGleitz/markdown-it-prism#137

[valeriangalliat]

Good find, thank you!

I'm thinking of tweaking it to escape everything inbetween the {} instead, like it was done for the markdown-it-prism issue you linked, something like this (on line 52):

const cls = lang ? ` class="${options.langPrefix}${md.utils.escapeHtml(lang)}"` : ''

Do you think that would make sense as well?

[ooooooo-q]

Certainly. If can use escapeHtml, it seems better.

[valeriangalliat]

👍 the patch is live on 3.3.1, thanks again!