HUGO

Missing escaping in code blocks

I was about to write a long github issue, but I think it’s better to be posted here with the solution:

TL;DR : blackfriday+syntax highlight=missing escaping of “<” and “>” in some case.

With Hugo 60, if you keep blackfriday, you need to know that syntax highlight is turned on by default with that version, so you probably need to specify in your config.toml:

[markup.highlight]
codeFences = false

Now a few details if highlight stays “true” for codeFences:

(sorry for the screenshots, but GitHub/Discourse interprets both Markdown and html)

The following code:
image

Correctly produce with Goldmark:

image

But with blackfriday:

image

That bug appeared with Hugo 60.

With Hugo 59.1 and blackfriday the result was:

image

Sadly the solution is not just to “specify HTML for your code blocks”, because the missing escaping also appears in other situation:

image

Generated with blackfriday and Hugo from 60 to current 61:

image

So when we don’t specify the kind of code, or the language is unknown, or with indented code block, some escaping is now missing, specifically for “<” and “>”.

Thanks to the release notes, I saw the only relevant change: Hugo 60: “Config option for code highlighting of code fences in Markdown is now default on. This is what most people wants.”

Meta: Sharing code in the forums

2 Likes

I wrote that test to demonstrate the bug https://github.com/tdelmas/hugo/pull/1 but as blackfriday will be deprecated (https://github.com/gohugoio/hugo/issues/6487) I didn’t go any further