Added additional escaping

This commit is contained in:
Jori Lallo
2016-08-02 11:36:15 +03:00
parent 4455877585
commit e0dd1d9a98

View File

@ -3,7 +3,7 @@ import marked from 'marked';
import sanitizedRenderer from 'marked-sanitized';
import highlight from 'highlight.js';
import emojify from './emojify';
import _escape from 'lodash/escape';
import _ from 'lodash';
slug.defaults.mode = 'rfc3986';
@ -11,11 +11,11 @@ const Renderer = sanitizedRenderer(marked.Renderer);
const renderer = new Renderer();
renderer.code = (code, language) => {
const validLang = !!(language && highlight.getLanguage(language));
const highlighted = validLang ? highlight.highlight(language, code).value : _escape(code);
return `<pre><code class="hljs ${language}">${highlighted}</code></pre>`;
const highlighted = validLang ? highlight.highlight(language, code).value : _.escape(code);
return `<pre><code class="hljs ${_.escape(language)}">${highlighted}</code></pre>`;
};
renderer.heading = (text, level) => {
const headingSlug = slug(text);
const headingSlug = _.escape(slug(text));
return `
<h${level}>
${text}