Entity-escape code/poetry blocks

developit · Feb 27, 2017 · a5cba52 · a5cba52
1 parent 4b87843
commit a5cba52
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 5 deletions.
diff --git a/src/index.js b/src/index.js
@@ -17,7 +17,7 @@ function outdent(str) {
  * @private
  */
 function encodeAttr(str) {
- return (str+'').replace(/"/g, '&quot;');
+ return (str+'').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
 }
 
 /** Parse Markdown into an HTML String. */
@@ -58,7 +58,7 @@ export default function parse(md) {
  }
  // Code/Indent blocks:
  else if (token[3] || token[4]) {
- chunk = '<pre class="code '+(token[4]?'poetry':token[2].toLowerCase())+'">'+outdent((token[3] || token[4]).replace(/^\n+|\n+$/g, ''))+'</pre>';
+ chunk = '<pre class="code '+(token[4]?'poetry':token[2].toLowerCase())+'">'+outdent(encodeAttr(token[3] || token[4]).replace(/^\n+|\n+$/g, ''))+'</pre>';
  }
  // > Quotes, -* lists:
  else if (token[6]) {
@@ -93,7 +93,7 @@ export default function parse(md) {
  }
  // `code`:
  else if (token[16]) {
- chunk = '<code>'+token[16]+'</code>';
+ chunk = '<code>'+encodeAttr(token[16])+'</code>';
  }
  // Inline formatting: *em*, **strong** & friends
  else if (token[17] || token[1]) {

diff --git a/test/index.js b/test/index.js
@@ -99,16 +99,25 @@ describe('snarkdown()', () => {
  expect(snarkdown('Here is some code `var a = 1`.')).to.equal('Here is some code <code>var a = 1</code>.');
  });
 
+ it('escapes inline code', () => {
+ expect(snarkdown('a `<">` b')).to.equal('a <code>&lt;&quot;&gt;</code> b');
+ });
+
  it('parses three backtricks (```) as a code block', () => {
- expect(snarkdown('```\nfunction codeBlocks() {\n\treturn "Can be inserted";\n}\n```')).to.equal('<pre class="code ">function codeBlocks() {\n\treturn "Can be inserted";\n}</pre>');
+ expect(snarkdown('```\nfunction codeBlocks() {\n\treturn "Can be inserted";\n}\n```')).to.equal('<pre class="code ">function codeBlocks() {\n\treturn &quot;Can be inserted&quot;;\n}</pre>');
 
- expect(snarkdown('```js\nfunction codeBlocks() {\n\treturn "Can be inserted";\n}\n```')).to.equal('<pre class="code js">function codeBlocks() {\n\treturn "Can be inserted";\n}</pre>');
+ expect(snarkdown('```js\nfunction codeBlocks() {\n\treturn "Can be inserted";\n}\n```')).to.equal('<pre class="code js">function codeBlocks() {\n\treturn &quot;Can be inserted&quot;;\n}</pre>');
  });
 
  it('parses tabs as a code poetry block', () => {
  expect(snarkdown('\tvar a = 1')).to.equal('<pre class="code poetry">var a = 1</pre>');
  });
 
+ it('escapes code/quote blocks', () => {
+ expect(snarkdown('```\n<foo>\n```')).to.equal('<pre class="code ">&lt;foo&gt;</pre>');
+ expect(snarkdown('\t<foo>')).to.equal('<pre class="code poetry">&lt;foo&gt;</pre>');
+ });
+
  it('parses a block quote', () => {
  expect(snarkdown('> To be or not to be')).to.equal('<blockquote>To be or not to be</blockquote>');
  });