Escape HTML special chars in error message

samwilson · Oct 28, 2023 · a2d810f · a2d810f
1 parent 979eb53
commit a2d810f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/includes/Diagrams.php b/includes/Diagrams.php
@@ -112,7 +112,7 @@ public function renderLocally( string $commandName, string $input, array $params
 				);
 				if ( $result->getExitCode() !== 0 ) {
 					$errorMessage = wfMessage( 'diagrams-error-generic', $commandName )
-						. ' ' . $result->getStderr() ?? $result->getStdout();
+						. ' ' . htmlspecialchars( $result->getStderr() ?? $result->getStdout() );
 					return $this->formatError( $errorMessage );
 				}
 				$status = $this->isPreview