LibMarkdown: Wrap code block language string in escape_html_entities()

This would allow HTML injection as the string was inserted into the HTML
output with no sanitation whatsoever.

Fixes #7123.

1 files changed, 1 insertions, 1 deletions

diff --git a/Userland/Libraries/LibMarkdown/CodeBlock.cpp b/Userland/Libraries/LibMarkdown/CodeBlock.cpp
index 3a6b8dff15..de2bb0958b 100644
--- a/Userland/Libraries/LibMarkdown/CodeBlock.cpp
+++ b/Userland/Libraries/LibMarkdown/CodeBlock.cpp
@@ -39,7 +39,7 @@ String CodeBlock::render_to_html() const
     if (style_language.is_empty())
         builder.append("<code>");
     else
-        builder.appendff("<code class=\"{}\">", style_language);
+        builder.appendff("<code class=\"{}\">", escape_html_entities(style_language));
 
     if (style_language == "js")
         builder.append(JS::MarkupGenerator::html_from_source(m_code));