fix: escape markdown preview HTML (#52)

tests/test_markdown_renderer.py

@@ -0,0 +1,25 @@
+import json
+import subprocess
+from pathlib import Path
+
+
+RENDERER = Path(__file__).parent.parent / "frontend" / "markdown.js"
+
+
+def test_markdown_renderer_escapes_raw_html_before_rendering_heading():
+    payload = "# <img src=x onerror=alert(document.domain)>"
+    script = (
+        f"const render = require({json.dumps(str(RENDERER))});"
+        f"process.stdout.write(render({json.dumps(payload)}));"
+    )
+
+    result = subprocess.run(
+        ["node", "-e", script],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+
+    assert result.stdout == (
+        "<h1>&lt;img src=x onerror=alert(document.domain)&gt;</h1>"
+    )