zio/elk
2
0
Fork 0
Code Releases 2 Packages 1 Activity

fix: prevent HTML injections to code blocks (#1165)

Browse source
This commit is contained in:
jviide 2023-01-15 12:48:22 +02:00 • committed by GitHub
parent 1a4fd19720
commit c15df78cbb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 88 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

14
composables/shiki.ts
View file

@ -48,10 +48,22 @@ export function useShikiTheme() {
return useColorMode().value === 'dark' ? 'vitesse-dark' : 'vitesse-light'
}
const HTML_ENTITIES = {
'<': '&lt;',
'>': '&gt;',
'&': '&amp;',
'\'': '&apos;',
'"': '&quot;',
} as Record<string, string>
function escapeHtml(text: string) {
return text.replace(/[<>&'"]/g, ch => HTML_ENTITIES[ch])
}
export function highlightCode(code: string, lang: Lang) {
const shiki = useHightlighter(lang)
if (!shiki)
return code
return escapeHtml(code)
return shiki.codeToHtml(code, {
lang,