Fix XSS in markdown preview

server/handlers.go

@@ -133,7 +133,8 @@ func (s *Server) previewHandler(w http.ResponseWriter, r *http.Request) {
 		}
 
 		if strings.HasPrefix(contentType, "text/x-markdown") || strings.HasPrefix(contentType, "text/markdown") {
-			output := blackfriday.MarkdownCommon(data)
+			escapedData := html.EscapeString(string(data))
+			output := blackfriday.MarkdownCommon([]byte(escapedData))
 			content = html_template.HTML(output)
 		} else if strings.HasPrefix(contentType, "text/plain") {
 			content = html_template.HTML(fmt.Sprintf("<pre>%s</pre>", html.EscapeString(string(data))))