codeblock tag : escape HTML code otherwise it will be interpreted by the browser

[LouisBarranqueiro]

Hey, when highlight.js is disabled, < must be escaped otherwise HTML code is interpreted by the browser.

[tommy351]

I think not only < but other HTML entities should be escaped too. You can try escapeHTML method in hexo-util.

[LouisBarranqueiro]

< is enough to escape an entire HTML code and more efficient than replace all HTML entities. As you can see, octopress do the same thing : https:/imathis/octopress/blob/master/plugins/code_block.rb#L82

[leesei]

@LouisBarranqueiro it think it's better to conform to standard and escape all the non-safe HTML entities with escapeHTML().

[LouisBarranqueiro]

Got it. I'm on it.

[leesei]

Our test case is asserting against non-escaped content:
https:/hexojs/hexo/blob/master/test/scripts/tags/code.js#L64
https:/hexojs/hexo/blob/master/test/scripts/tags/code.js#L94

Adding other tag parameters disabled highlight:
https:/hexojs/hexo/blob/master/test/scripts/tags/code.js#L103
https:/hexojs/hexo/blob/master/test/scripts/tags/code.js#L114

[LouisBarranqueiro]

Thanks dude

[leesei]

Thank you 😉