nhn / tui.editor

🍞📝 Markdown WYSIWYG Editor. GFM Standard + Chart & UML Extensible.
http://ui.toast.com/tui-editor
MIT License
16.91k stars 1.71k forks source link

Syntax highlighter does not escape XML-entities when language is unknown or unspecified #3220

Open hexwayteam opened 5 months ago

hexwayteam commented 5 months ago

Describe the bug

Code sample inside code block get interpreted as HTML-tags while using codeSyntaxtHighlight + Prism without specifying a language

To Reproduce

Fiddle: https://jsfiddle.net/xv09fd76/

const { Editor } = toastui;
const { codeSyntaxHighlight } = Editor.plugin;

const viewer = new Editor.factory({
  el: document.getElementById('viewer'),
  viewer: true,
  initialValue: `\`\`\`
  Image tag: <img src="example.com">
  Div tag: <div data-foo="bar" style="color: red">Hello!</div>
  \`\`\``,
  plugins: [[codeSyntaxHighlight, { highlighter: Prism }]]
});

Expected behavior

Code samples aren't interpreted as HTML

Desktop (please complete the following information):

Smartphone (please complete the following information):

not tested

Additional context

HTML tags are correctly escaped when correct language is specified:

```html
<div />

HTML-tags are also correctly escaped without `codeSyntaxHIghlight`-plugin