From d0579a57d66f2d58fad00f914736f90f5f9485e9 Mon Sep 17 00:00:00 2001
From: Lim Chee Aun <cheeaun@gmail.com>
Date: Sat, 17 Dec 2022 17:24:26 +0800
Subject: [PATCH] Fix bug when text nodes contain HTML <>

Text nodes don't escape them
---
 src/utils/enhance-content.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/utils/enhance-content.js b/src/utils/enhance-content.js
index 783bcff..4783f3c 100644
--- a/src/utils/enhance-content.js
+++ b/src/utils/enhance-content.js
@@ -20,7 +20,7 @@ function enhanceContent(content, opts = {}) {
   // Convert :shortcode: to <img />
   let textNodes = extractTextNodes(dom);
   textNodes.forEach((node) => {
-    let html = node.nodeValue;
+    let html = node.nodeValue.replace(/</g, '&lt;').replace(/>/g, '&gt;');
     if (emojis) {
       html = emojifyText(html, emojis);
     }
@@ -34,7 +34,7 @@ function enhanceContent(content, opts = {}) {
   // Convert `code` to <code>code</code>
   textNodes = extractTextNodes(dom);
   textNodes.forEach((node) => {
-    let html = node.nodeValue;
+    let html = node.nodeValue.replace(/</g, '&lt;').replace(/>/g, '&gt;');
     if (/`[^`]+`/g.test(html)) {
       html = html.replaceAll(/(`[^]+?`)/g, '<code>$1</code>');
     }