Skip to content

HTML is rendered when an incorrect language is specified in the code block #3309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
salihozkara opened this issue May 22, 2025 · 0 comments
Labels

Comments

@salihozkara
Copy link

Describe the bug

When an incorrect or unsupported language is specified for a code block using the "Code Syntax Highlighting Plugin," the HTML content within the code block is rendered directly into the page instead of being displayed as plain text.

To Reproduce

Steps to reproduce the behavior:

  1. Go to the "With All Plugins" example on the documentation site/demo.
  2. Scroll down to the "Code Syntax Highlighting Plugin" section.
  3. In the left-hand editor pane (the input area), enter a code block with wrong as the language specifier, but include HTML content within it. For example:
    <div id="editor" style="display:block"><span>baz</span></div>
    
  4. Observe the right-hand preview pane.

Expected behavior

The HTML content within the code block should be displayed as plain text, with syntax highlighting applied if the specified language is valid and supported. It should not be rendered by the browser as live HTML.

Screenshots

Image

Image

Image

Additional context

This issue affects the "Code Syntax Highlighting Plugin." Rendering arbitrary HTML from code blocks can lead to unexpected UI changes and potential security vulnerabilities if untrusted input is processed. The plugin should sanitize or escape HTML within code blocks to ensure it's displayed as text.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant