LibMarkdown: Escape HTML entities in text

Author: https://github.com/linusg
Commit: 0a1ecbec48
Pull-request: https://github.com/SerenityOS/serenity/pull/2120

Libraries/LibMarkdown/CodeBlock.cpp

@@ -60,7 +60,6 @@ String CodeBlock::render_to_html() const
     else
         builder.appendf("<code style=\"white-space: pre;\" class=\"%s\">", style_language.characters());
 
-    // TODO: This should also be done in other places.
     builder.append(escape_html_entities(m_code));
 
     builder.append("</code>");

Libraries/LibMarkdown/Text.cpp

@@ -113,7 +113,7 @@ String Text::render_to_html() const
         }
 
         current_style = span.style;
-        builder.append(span.text);
+        builder.append(escape_html_entities(span.text));
     }
 
     for (ssize_t i = open_tags.size() - 1; i >= 0; --i) {