markup/highlight: Escape lang in default code block rendering

markup/goldmark/codeblocks/codeblocks_integration_test.go

@@ -408,3 +408,32 @@ Some code.
 
 	b.AssertFileContent("public/p1/index.html", "p1.md:7:1")
 }
+
+func TestCodeblockLangEscape(t *testing.T) {
+	t.Parallel()
+
+	files := `
+-- hugo.toml --
+-- layouts/single.html --
+{{ .Content }}
+-- content/p1.md --
+---
+title: "p1"
+---
+
+## Simple
+
+§§§a"><script>A</script>
+Some code.
+§§§
+
+§§§a"><script>B</script> {hl_inline=true}
+Some code.
+§§§
+
+`
+
+	b := hugolib.Test(t, files)
+
+	b.AssertFileContent("public/p1/index.html", "! <script>")
+}

markup/highlight/highlight.go

@@ -275,6 +275,7 @@ func (p *preWrapper) Start(code bool, styleAttr string) string {
 }
 
 func inlineCodeAttrs(lang string) string {
+	lang = gohtml.EscapeString(lang)
 	return fmt.Sprintf(` class="code-inline language-%s"`, lang)
 }
 
@@ -282,6 +283,7 @@ func WritePreStart(w io.Writer, language, styleAttr string) {
 	fmt.Fprintf(w, `<pre tabindex="0"%s>`, styleAttr)
 	fmt.Fprint(w, "<code")
 	if language != "" {
+		language = gohtml.EscapeString(language)
 		fmt.Fprint(w, ` class="language-`+language+`"`)
 		fmt.Fprint(w, ` data-lang="`+language+`"`)
 	}