diff --git a/spec/ui-spec.js b/spec/ui-spec.js index 8ad5e0e66..26dda6081 100644 --- a/spec/ui-spec.js +++ b/spec/ui-spec.js @@ -1,3 +1,4 @@ +const dedent = require('dedent'); describe("Renders Markdown", () => { describe("properly when given no opts", () => { @@ -7,6 +8,26 @@ describe("Renders Markdown", () => { }); }); + it(`escapes HTML in code blocks properly`, () => { + let input = dedent` + Lorem ipsum dolor. + + \`\`\`html +
sit amet
+ \`\`\` + ` + + let expected = dedent` +Lorem ipsum dolor.
+<p>sit amet</p>
+
+ `
+
+ expect(
+ atom.ui.markdown.render(input).trim()
+ ).toBe(expected);
+ })
+
describe("transforms links correctly", () => {
it("makes no changes to a fqdn link", () => {
expect(atom.ui.markdown.render("[Hello World](https://github.com)"))
diff --git a/src/ui.js b/src/ui.js
index 2a4662c44..66d208209 100644
--- a/src/ui.js
+++ b/src/ui.js
@@ -249,8 +249,8 @@ function renderMarkdown(content, givenOpts = {}) {
// Here we can add some simple additions that make code highlighting possible later on,
// but doesn't actually preform any code highlighting.
- md.options.highlight = function(str, lang) {
- return `${str}
`;
+ md.options.highlight = function (str, lang) {
+ return `${md.utils.escapeHtml(str)}
`;
};
// Process disables