Bjørn Erik Pedersen e4dc48cf7f markup: Escape code-fence attribute values in the default renderer ...

The default fenced-code-block renderer wrote attribute values from the
info string into the wrapper element without escaping. New converts each
value from a []byte to a string, so RenderAttributes' []byte escaping
branch was never reached and values were written verbatim; the class
value in writeDivStart was likewise unescaped. A quote in a value could
close the attribute and inject a further one, e.g. an event handler.

Escape string attribute values too, and escape the class value.

See CVE-2026-10618.
See #15247.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-08-28 13:03:09 +02:00

..

codeblocks_integration_test.go

markup: Escape code-fence attribute values in the default renderer

2026-08-28 13:03:09 +02:00

render.go

markup/goldmark/codeblocks: Always split Chroma options into .Options

2026-05-19 12:23:42 +02:00