fix(#184): escape the overlay's plain-text fallback

[itsmunzir]

Fixes #184

speculativeHighlightUpdate returns the editor's text unchanged when the overlay has no .line spans. Two ordinary paths reach it: the overlay is empty until the highlighter's first pass, and a sanitizer that strips Shiki's <span class="line"> wrappers leaves it that way permanently. The caller renders the return value with {@html displayedOverlay.html} and never runs the configured sanitizer over this path, so markup typed into the editor was parsed and executed inside the overlay (the report's <img onerror> repro).

The fallback now escapes &, < and >. With no highlighted lines to patch, the overlay shows plain text either way, so the escape changes how the text is parsed, not what it says.

Test

The repo has no test runner, so this ships a dependency-free node:test check that runs the reported repro against the built package:

pnpm --filter carta-md build
node --test packages/carta-md/test/speculative.test.mjs

The old code fails it (the returned string still contains <img); the new code passes. Happy to move it under a runner if you add one later.

[BearToCode]

Thanks for your contribution. However, I think it's a better idea to just update the following function by calling the sanitizer specified as a carta option:

carta/packages/carta-md/src/lib/internal/components/Input.svelte

Lines 131 to 161 in 3310d24

	/**
	* Returns the highlighted text using a speculative update.
	* @param text The text to highlight.
	*/
	function speculativeHighlight(value: string) {
	const timestamp = new Date().getTime();
	if (!mounted) return { html: '', timestamp };
	const currentOverlay = highlightElem.innerHTML;
	if (highlightElem) {
	try {
	const html = speculativeHighlightUpdate(currentlyHighlightedValue, value, currentOverlay);
	currentlyHighlightedValue = value;
	return { html, timestamp };
	} catch (e) {
	console.error(`Error executing speculative update: ${e}.`);
	// The overlay still holds the previous text, but the debounced highlight is already
	// on its way and will render `value`. Keep the baseline in sync with it, otherwise it
	// stays at the pre-change text and the next patch sees the whole document as added,
	// replaying it into the overlay (the text is duplicated until the debounce lands).
	currentlyHighlightedValue = value;
	}
	}
	return {
	html: highlightElem.innerHTML,
	timestamp
	};
	}

[itsmunzir]

Thanks - I see you implemented it on the branch. The speculative path now runs the configured carta.sanitizer, the manual escape is dropped, and the early return is back, which matches the rework I was about to send, so I dropped my duplicate commit. Nothing else from me on this one; ready when you are.

[github-actions]

🎉 This PR is included in version carta-md-v4.11.4 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀