Merge pull request #151 from calebeby/escape-html-in-error

Escape HTML in error message/recommendation
shikijs · Apr 20, 2022 · 78bebc3 · 78bebc3
2 parents 1f3399c + aa047ea
commit 78bebc3
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 3 deletions.
diff --git a/.changeset/green-colts-battle.md b/.changeset/green-colts-battle.md
@@ -0,0 +1,5 @@
+---
+"remark-shiki-twoslash": patch
+---
+
+Escape HTML in error message/recommendation
diff --git a/packages/remark-shiki-twoslash/src/exceptionMessageDOM.ts b/packages/remark-shiki-twoslash/src/exceptionMessageDOM.ts
@@ -87,9 +87,9 @@ export const setupNodeForTwoslashException = (code: string, node: Node, error: u
 
     const bodyFromTwoslashError = (error: TwoslashError) =>  {
         return `
-<h3>${error.title}</h3>
-<p>${error.description.replace(/(?:\r\n|\r|\n)/g, '<br>')}</p>
-<code>${error.recommendation.replace(/(?:\r\n|\r|\n)/g, '<br>')}</code>
+<h3>${escapeHtml(error.title)}</h3>
+<p>${escapeHtml(error.description).replace(/(?:\r\n|\r|\n)/g, "<br>")}</p>
+<code>${escapeHtml(error.recommendation).replace(/(?:\r\n|\r|\n)/g, "<br>")}</code>
 `
     }