Doc: escape string array litral as HTML to prevent XSS

crystal-lang · Nov 8, 2017 · 060f404 · 060f404
1 parent ebf6006
commit 060f404
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/compiler/crystal/tools/doc/highlighter.cr b/src/compiler/crystal/tools/doc/highlighter.cr
@@ -119,7 +119,7 @@ module Crystal::Doc::Highlighter
       case token.type
       when :STRING
         io << " " unless first
-        io << token.value
+        HTML.escape(token.raw, io)
         first = false
       when :STRING_ARRAY_END
         io << ")"