Add missing escaping of Code block content in save function

package.json

@@ -21,6 +21,7 @@
  "@wordpress/components": "^9.8.0",
  "@wordpress/editor": "^9.18.0",
  "@wordpress/element": "^2.14.0",
+ "@wordpress/escape-html": "1.8.0",
  "@wordpress/hooks": "^2.8.0",
  "@wordpress/i18n": "^3.13.0",
  "@wordpress/scripts": "^11.0.0",

src/index.js

@@ -25,6 +25,7 @@ import * as BlockEditor from '@wordpress/block-editor';
  * Internal dependencies
  */
 import languagesNames from './language-names';
+import { escape } from './utils';
 
 /**
  * Extend code block with syntax highlighting.
@@ -272,7 +273,7 @@ const extendCodeBlockWithSyntaxHighlighting = (settings) => {
  save({ attributes }) {
  return (
  <pre>
- <code>{attributes.content}</code>
+ <code>{escape(attributes.content)}</code>
  </pre>
  );
  },

src/utils.js

@@ -0,0 +1,63 @@
+// Copied from Gutenberg v8.3.0: https://github.com/WordPress/gutenberg/blob/aaa0b32d6d4a82d1e955569c14960f02549bae99/packages/block-library/src/code/utils.js
+
+/**
+ * External dependencies
+ */
+import { flow } from 'lodash';
+
+/**
+ * WordPress dependencies
+ */
+import { escapeEditableHTML } from '@wordpress/escape-html';
+
+/**
+ * Escapes ampersands, shortcodes, and links.
+ *
+ * @param {string} content The content of a code block.
+ * @return {string} The given content with some characters escaped.
+ */
+export function escape(content) {
+ return flow(
+ escapeEditableHTML,
+ escapeOpeningSquareBrackets,
+ escapeProtocolInIsolatedUrls
+ )(content || '');
+}
+
+/**
+ * Returns the given content with all opening shortcode characters converted
+ * into their HTML entity counterpart (i.e. [ => [). For instance, a
+ * shortcode like [embed] becomes [embed]
+ *
+ * This function replicates the escaping of HTML tags, where a tag like
+ * <strong> becomes &lt;strong>.
+ *
+ * @param {string} content The content of a code block.
+ * @return {string} The given content with its opening shortcode characters
+ * converted into their HTML entity counterpart
+ * (i.e. [ => &#91;)
+ */
+function escapeOpeningSquareBrackets(content) {
+ return content.replace(/\[/g, '&#91;');
+}
+
+/**
+ * Converts the first two forward slashes of any isolated URL into their HTML
+ * counterparts (i.e. // => &#47;&#47;). For instance, https://youtube.com/watch?x
+ * becomes https:&#47;&#47;youtube.com/watch?x.
+ *
+ * An isolated URL is a URL that sits in its own line, surrounded only by spacing
+ * characters.
+ *
+ * See https://github.com/WordPress/wordpress-develop/blob/5.1.1/src/wp-includes/class-wp-embed.php#L403
+ *
+ * @param {string} content The content of a code block.
+ * @return {string} The given content with its ampersands converted into
+ * their HTML entity counterpart (i.e. & => &amp;)
+ */
+function escapeProtocolInIsolatedUrls(content) {
+ return content.replace(
+ /^(\s*https?:)\/\/([^\s<>"]+\s*)$/m,
+ '$1&#47;&#47;$2'
+ );
+}