From 7c83374e866c5787b32a4cfe0ff4e39da30db183 Mon Sep 17 00:00:00 2001
From: yuyinws <lyc657508366@gmail.com>
Date: Tue, 20 Aug 2024 11:46:35 +0800
Subject: [PATCH] fix: escapeHtml for title

---
 src/node/markdown/plugins/containers.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/node/markdown/plugins/containers.ts b/src/node/markdown/plugins/containers.ts
index fd685ab1..bbed26ae 100644
--- a/src/node/markdown/plugins/containers.ts
+++ b/src/node/markdown/plugins/containers.ts
@@ -48,7 +48,7 @@ export const containerPlugin = (
       render: (tokens: Token[], idx: number) =>
         tokens[idx].nesting === 1 ? `<div class="vp-raw">\n` : `</div>\n`
     })
-    .use(...createCodeGroup(options))
+    .use(...createCodeGroup(options, md))
 }
 
 type ContainerArgs = [typeof container, string, { render: RenderRule }]
@@ -79,7 +79,7 @@ function createContainer(
   ]
 }
 
-function createCodeGroup(options: Options): ContainerArgs {
+function createCodeGroup(options: Options, md: MarkdownIt): ContainerArgs {
   return [
     container,
     'code-group',
@@ -111,7 +111,7 @@ function createCodeGroup(options: Options): ContainerArgs {
 
               if (title) {
                 const id = nanoid(7)
-                tabs += `<input type="radio" name="group-${name}" id="tab-${id}" ${checked}><label data-title="${title}" for="tab-${id}">${title}</label>`
+                tabs += `<input type="radio" name="group-${name}" id="tab-${id}" ${checked}><label data-title="${md.utils.escapeHtml(title)}" for="tab-${id}">${title}</label>`
 
                 if (checked && !isHtml) tokens[i].info += ' active'
                 checked = ''