From 0d403d8e83471207b69e9973920deef0d4a53d72 Mon Sep 17 00:00:00 2001
From: Karishma Chadha <kchadha@scratch.mit.edu>
Date: Thu, 14 Jun 2018 11:39:03 -0400
Subject: [PATCH] XML escape comment text.

---
 src/engine/comment.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/engine/comment.js b/src/engine/comment.js
index 6dec2f0f4..34bbcabd5 100644
--- a/src/engine/comment.js
+++ b/src/engine/comment.js
@@ -5,6 +5,7 @@
 
 const uid = require('../util/uid');
 const Cast = require('../util/cast');
+const xmlEscape = require('../util/xml-escape');
 
 class Comment {
     /**
@@ -31,7 +32,7 @@ class Comment {
     toXML () {
         return `<comment id="${this.id}" x="${this.x}" y="${
             this.y}" w="${this.width}" h="${this.height}" pinned="${
-            this.blockId !== null}" minimized="${this.minimized}">${this.text}</comment>`;
+            this.blockId !== null}" minimized="${this.minimized}">${xmlEscape(this.text)}</comment>`;
     }
 
     // TODO choose min and defaults for width and height