Merge pull request #1907 from nextcloud/chore/escape-inline-markdown

benjaminfrueh · web-flow · commit 29d3637dca09 · 2026-06-25T12:52:33.000+02:00
chore: escape inline markdown content
diff --git a/src/components/EditorMarkdownIt.vue b/src/components/EditorMarkdownIt.vue
@@ -160,7 +160,7 @@ export default {
 		setInlineCodeRule() {
 			this.md.renderer.rules.code_inline = function(tokens, idx, options, env, self) {
 				const token = tokens[idx]
-				return '<code class="inline-code">' + token.content + '</code>'
+				return '<code class="inline-code">' + escapeHtml(token.content) + '</code>'
 			}
 		},
 	},

Original file line number	Diff line number	Diff line change
`@@ -160,7 +160,7 @@ export default {`
`160`	`160`	`setInlineCodeRule() {`
`161`	`161`	`this.md.renderer.rules.code_inline = function(tokens, idx, options, env, self) {`
`162`	`162`	`const token = tokens[idx]`
`163`		`- return '<code class="inline-code">' + token.content + '</code>'`
	`163`	`+ return '<code class="inline-code">' + escapeHtml(token.content) + '</code>'`
`164`	`164`	`}`
`165`	`165`	`},`
`166`	`166`	`},`