discord-markdown - npm Package Compare versions

Comparing version 2.3.0 to 2.3.1

CHANGELOG.md

@@ -0,1 +1,7 @@
+# [2.3.1](https://github.com/brussell98/discord-markdown/compare/v2.3.0...v2.3.1) (2020-02-20)
+
+### Fixes
+
+- Code blocks without highlighting were not escaping HTML, allowing the browser to render arbitrary HTML
+
 # [2.3.0](https://github.com/brussell98/discord-markdown/compare/v2.2.0...v2.3.0) (2020-02-04)
@@ -2,0 +8,0 @@

index.js

@@ -60,3 +60,3 @@ const markdown = require('simple-markdown');
 			if (node.lang && highlight.getLanguage(node.lang))
-				code = highlight.highlight(node.lang, node.content, true); // Discord seems to set ignore ignoreIllegals: true
+				code = highlight.highlight(node.lang, node.content, true); // Discord seems to set ignoreIllegals: true
 
@@ -68,3 +68,3 @@ if (code && state.cssModuleNames) // Replace classes in hljs output
 			return htmlTag('pre', htmlTag(
-				'code', code ? code.value : node.content, { class: `hljs${code ? ' ' + code.language : ''}` }, state
+				'code', code ? code.value : markdown.sanitizeText(node.content), { class: `hljs${code ? ' ' + code.language : ''}` }, state
 			), null, state);
@@ -71,0 +71,0 @@ }

package.json

 {
 	"name": "discord-markdown",
-	"version": "2.3.0",
+	"version": "2.3.1",
 	"description": "A markdown parser for Discord messages",
@@ -5,0 +5,0 @@ "keywords": [

test/single.test.js

@@ -112,2 +112,6 @@ const markdown = require('../index');
 		.toBe('<b>test</b>');
+	expect(markdown.toHTML('```\n\n<b>test</b>\n```'))
+		.toBe('<pre><code class="hljs">&lt;b&gt;test&lt;/b&gt;</code></pre>');
+	expect(markdown.toHTML('```html\n\n<b>test</b>\n```'))
+		.toBe('<pre><code class="hljs html"><span class="hljs-tag">&lt;<span class="hljs-name">b</span>&gt;</span>test<span class="hljs-tag">&lt;/<span class="hljs-name">b</span>&gt;</span></code></pre>');
 });
@@ -114,0 +118,0 @@

No alert changes

Improved metrics

Total package byte prevSize

191597

increased by0.32%

Lines of code

613

increased by0.66%

No dependency changes