In Combined view, HTML in the OP_EQ section is not escaped

[aaronpk]

To reproduce:

$old = '<b>three</b>';

$new = 'one
<b>two</b>
<b>three</b>';

echo Jfcherng\Diff\DiffHelper::calculate($old, $new, 'Combined');

Output (newlines added for readability):

<table class="diff-wrapper diff diff-html diff-combined">
  <thead><tr><th>Differences</th></tr></thead>
<tbody class="change change-ins">
  <tr data-type="+">
    <td class="new">one</td>
  </tr>
  <tr data-type="+">
    <td class="new">&lt;b&gt;two&lt;/b&gt;</td>
  </tr>
</tbody>
<tbody class="change change-eq">
  <tr data-type=" ">
    <td class="new"><b>three</b></td>
  </tr>
</tbody>
</table>

The line <b>two</b> is properly escaped as <b>two</b>, but <b>three</b> is output literally.

This may lead to XSS if the diffed text that didn't change contains JavaScript.

[jfcherng]

Thanks. Fixed in d32c7b6.

---

6.7.4 has been released.

[aaronpk]

Thanks for the quick fix!