paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-11-07 15:33:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

fenced_code: Escape code_language on output in wrapped_code.

Browse Source 
Strings should be escaped at the point of interpolation into a
template, not before.  In this case, the early escape was hiding the
bug that code_language was only escaped if it was not found in
pygments_data.

Signed-off-by: Anders Kaseorg <anders@zulip.com>
This commit is contained in:
Anders Kaseorg
2020-11-02 15:44:17 -08:00
committed by Tim Abbott
parent ac5cbf7693
commit 26f630dfa1
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
static/shared/js/fenced_code.js
View File

@@ -46,8 +46,10 @@ export function wrap_code(code, lang) {
// the `/shared` folder. To handle such a case we check if pygments data is empty and fallback to // the `/shared` folder. To handle such a case we check if pygments data is empty and fallback to
// using the default header if it is. // using the default header if it is.
if (lang !== undefined && lang !== "" && Object.keys(pygments_data).length > 0) { if (lang !== undefined && lang !== "" && Object.keys(pygments_data).length > 0) {
const code_language = _.get(pygments_data, [lang, "pretty_name"], _.escape(lang)); const code_language = _.get(pygments_data, [lang, "pretty_name"], lang);
header = `<div class="codehilite" data-code-language="${code_language}"><pre><span></span><code>`; header = `<div class="codehilite" data-code-language="${_.escape(
code_language,
)}"><pre><span></span><code>`;
} }
// Trim trailing \n until there's just one left // Trim trailing \n until there's just one left
// This mirrors how pygments handles code input // This mirrors how pygments handles code input