ngdoc should escape content of pre in markdown

2 files changed, 8 insertions, 6 deletions

diff --git a/docs/spec/ngdocSpec.js b/docs/spec/ngdocSpec.js
index cf469063..4abaf0c4 100644
--- a/docs/spec/ngdocSpec.js
+++ b/docs/spec/ngdocSpec.js
@@ -62,12 +62,12 @@ describe('ngdoc', function(){
         toEqual('<p><tt>&lt;angular/&gt;</tt></p>');
     });
 
-    it('should not replace anything in <pre>', function(){
-      expect(markdown('bah x\n<pre>\nangular.k\n</pre>\n asdf x')).
+    it('should not replace anything in <pre>, but escape the html escape the content', function(){
+      expect(markdown('bah x\n<pre>\n<b>angular</b>.k\n</pre>\n asdf x')).
         toEqual(
             '<p>bah x</p>' +
             '<div ng:non-bindable><pre class="brush: js; html-script: true;">\n' +
-            'angular.k\n' +
+            '&lt;b&gt;angular&lt;/b&gt;.k\n' +
             '</pre></div>' +
             '<p>asdf x</p>');
     });
diff --git a/docs/src/ngdoc.js b/docs/src/ngdoc.js
index f1ca8d7e..038dda06 100644
--- a/docs/src/ngdoc.js
+++ b/docs/src/ngdoc.js
@@ -421,9 +421,11 @@ function markdown (text) {
 
   parts.forEach(function(text, i){
     if (text.match(/^<pre>/)) {
-      text = text.
-        replace(/^<pre>/, '<div ng:non-bindable><pre class="brush: js; html-script: true;">').
-        replace(/<\/pre>/, '</pre></div>');
+      text = text.replace(/^<pre>([\s\S]*)<\/pre>/mi, function(_, content){
+        return '<div ng:non-bindable><pre class="brush: js; html-script: true;">' +
+                content.replace(/</g, '&lt;').replace(/>/g, '&gt;') +
+               '</pre></div>';
+      });
     } else {
       text = text.replace(/<angular\/>/gm, '<tt>&lt;angular/&gt;</tt>');
       text = new Showdown.converter().makeHtml(text.replace(/^#/gm, '###'));