From ffbbcd65c1b621cec496e89d400cb0bf35eb3845 Mon Sep 17 00:00:00 2001
From: Tuomas Hietanen <thorium@iki.fi>
Date: Tue, 28 Oct 2025 16:59:08 +0000
Subject: [PATCH] Some html encodes added (to prevent XSS)

---
 src/FSharp.Formatting.Markdown/HtmlFormatting.fs | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/FSharp.Formatting.Markdown/HtmlFormatting.fs b/src/FSharp.Formatting.Markdown/HtmlFormatting.fs
index 600bd742d..b492289a5 100644
--- a/src/FSharp.Formatting.Markdown/HtmlFormatting.fs
+++ b/src/FSharp.Formatting.Markdown/HtmlFormatting.fs
@@ -76,7 +76,7 @@ let rec internal formatSpan (ctx: FormattingContext) span =
         // use mathjax grammar, for detail, check: http://www.mathjax.org/
         ctx.Writer.Write("<span class=\"math\">\\(" + (htmlEncode body) + "\\)</span>")
 
-    | AnchorLink(id, _) -> ctx.Writer.Write("<a name=\"" + id + "\">&#160;</a>")
+    | AnchorLink(id, _) -> ctx.Writer.Write("<a name=\"" + htmlEncodeQuotes id + "\">&#160;</a>")
     | EmbedSpans(cmd, _) -> formatSpans ctx (cmd.Render())
     | Literal(str, _) -> ctx.Writer.Write(str)
     | HardLineBreak(_) -> ctx.Writer.Write("<br />" + ctx.Newline)
@@ -181,7 +181,8 @@ let rec internal formatParagraph (ctx: FormattingContext) paragraph =
 
         if ctx.GenerateHeaderAnchors then
             let anchorName = formatAnchor ctx spans
-            ctx.Writer.Write(sprintf """<a name="%s" class="anchor" href="#%s">""" anchorName anchorName)
+            let safeAnchorName = htmlEncodeQuotes anchorName
+            ctx.Writer.Write(sprintf """<a name="%s" class="anchor" href="#%s">""" safeAnchorName safeAnchorName)
             formatSpans ctx spans
             ctx.Writer.Write "</a>"
         else
@@ -210,7 +211,7 @@ let rec internal formatParagraph (ctx: FormattingContext) paragraph =
         if String.IsNullOrWhiteSpace(language) then
             ctx.Writer.Write(sprintf "<pre><code>")
         else
-            let langCode = sprintf "language-%s" language
+            let langCode = sprintf "language-%s" (htmlEncodeQuotes language)
             ctx.Writer.Write(sprintf "<pre><code class=\"%s\">" langCode)
 
         ctx.Writer.Write(htmlEncode code)