Added html encoding when sending back the output

zabirauf · Sep 18, 2014 · 9defebb · 9defebb
1 parent 08c1bcf
commit 9defebb
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/Kernel/Kernel.csproj b/Kernel/Kernel.csproj
@@ -47,6 +47,7 @@
     </Reference>
     <Reference Include="System" />
     <Reference Include="System.Core" />
+    <Reference Include="System.Web" />
     <Reference Include="System.Xml.Linq" />
     <Reference Include="System.Data.DataSetExtensions" />
     <Reference Include="Microsoft.CSharp" />

diff --git a/Kernel/Shell/ExecuteRequestHandler.cs b/Kernel/Shell/ExecuteRequestHandler.cs
@@ -6,6 +6,7 @@
 using System.Text;
 using System.Threading;
 using iCSharp.Kernel.ScriptEngine;
+using System.Web;
 
 namespace iCSharp.Kernel.Shell
 {
@@ -88,7 +89,8 @@ private string GetCodeHtmlOutput(ExecutionResult executionResult)
             StringBuilder sb = new StringBuilder();
             foreach (Tuple<string, ConsoleColor> tuple in executionResult.OutputResultWithColorInformation)
             {
-                sb.Append(string.Format("<font style=\"color:{0}\">{1}</font>", tuple.Item2.ToString(), tuple.Item1));
+                string encoded = HttpUtility.HtmlEncode(tuple.Item1);
+                sb.Append(string.Format("<font style=\"color:{0}\">{1}</font>", tuple.Item2.ToString(), encoded));
             }
 
             return sb.ToString();