[naaz234]

Description

The codehilite extension's non-Pygments output builds the <code> element's class attribute from the language name without escaping it. In CodeHilite.hilite, the fallback branch (reached when Pygments is not installed or use_pygments is False) does classes.append('{}{}'.format(self.lang_prefix, self.lang)) and then ' class="{}"'.

When codehilite is used together with attr_list, the language is taken from a fenced-block class token. The attr_list scanner allows any character in a class token except space, = and }, which includes ", < and >. So an input such as:

```{.a"><script>alert(1)</script>}
code
```

produces class="language-a"><script>alert(1)</script>", which closes the attribute and injects a live <script> element (stored XSS for anything rendering untrusted Markdown in that configuration). The language can also be set directly, e.g. CodeHilite('x', lang='"><script>', use_pygments=False).

The fenced_code extension already escapes the language in its own non-Pygments branch with _escape_attrib_html; this applies the same escaping at the one site in codehilite that missed it. Valid language names are unchanged. Added a regression test (runs without Pygments via use_pygments=False) and a changelog entry.

AI Assistance Disclosure

• No AI tools were used in preparing this PR.

• AI tools were used and I have disclosed which ones, and have fully reviewed and verified their output.

  AI tools were use to assist with the following:

  • Code
  • Code Comments
  • Documentation
  • Changelog Entry
  • Commit Message
  • The Description Above
  • Other: ______________

  Claude (Anthropic) was used to help locate the issue, draft the patch, the test, the changelog entry, the commit message, and this description. I reviewed and verified all of it, and can explain the change.

Checklist

• This PR follows the contribution guidelines.
• The code follows the Code Style Guide.
• The commit message follows the Commit Message Style Guide.
• I have added or updated relevant docs, including release notes if applicable which follow the Documentation Style Guide.
• I have added or updated relevant tests.
• I have not requested, and will not request, an automated AI review for this PR.

[waylan]

I want to point out our policy on Sanitizing Output. In short, that is out-of-scope. That said, if we are normally escaping an input and are only missing it in one edge case, that is different. In the future, please do not present these sorts of fixes as preventing XSS. I have edited the changelog entry to better reflect the justification for the change.

[naaz234]

Understood, I hadn't read the sanitisation policy closely enough. I'll frame these as consistency fixes rather than XSS going forward, and the changelog wording you went with reads better. Thanks for merging.