Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

fenced_code: Escape code_language on output in wrapped_code. 

Strings should be escaped at the point of interpolation into a
template, not before.  In this case, the early escape was hiding the
bug that code_language was only escaped if it was not found in
pygments_data.

Signed-off-by: Anders Kaseorg <anders@zulip.com>
This commit is contained in:
Anders Kaseorg 2020-11-02 15:44:17 -08:00 committed by Tim Abbott
parent ac5cbf7693
commit 26f630dfa1
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
static/shared/js/fenced_code.js
View File

@ -46,8 +46,10 @@ export function wrap_code(code, lang) {
// the `/shared` folder. To handle such a case we check if pygments data is empty and fallback to
// using the default header if it is.
if (lang !== undefined && lang !== "" && Object.keys(pygments_data).length > 0) {
const code_language = _.get(pygments_data, [lang, "pretty_name"], _.escape(lang));
header = `<div class="codehilite" data-code-language="${code_language}"><pre><span></span><code>`;
const code_language = _.get(pygments_data, [lang, "pretty_name"], lang);
header = `<div class="codehilite" data-code-language="${_.escape(
code_language,
)}"><pre><span></span><code>`;
}
// Trim trailing \n until there's just one left
// This mirrors how pygments handles code input