Command Line: Escape markup in command line output (#3341)

PrismJS · Feb 16, 2022 · e002e78 · e002e78
1 parent 13b56a9
commit e002e78
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/plugins/command-line/prism-command-line.js b/plugins/command-line/prism-command-line.js
@@ -143,8 +143,10 @@
 		for (var i = 0, l = codeLines.length; i < l; i++) {
 			// Add spans to allow distinction of input/output text for styling
 			if (outputLines.hasOwnProperty(i)) {
+				// outputLines were removed from codeLines so missed out on escaping
+				// of markup so do it here.
 				codeLines[i] = '<span class="token output">'
-					+ outputLines[i] + '</span>';
+					+ Prism.util.encode(outputLines[i]) + '</span>';
 			} else {
 				codeLines[i] = '<span class="token command">'
 					+ codeLines[i] + '</span>';

diff --git a/plugins/command-line/prism-command-line.min.js b/plugins/command-line/prism-command-line.min.js