add escape

packages/artplayer/src/subtitle.js

@@ -1,4 +1,4 @@
-import { setStyles, srtToVtt, vttToBlob, getExt, assToVtt } from './utils';
+import { setStyles, srtToVtt, vttToBlob, getExt, assToVtt, escape } from './utils';
 import Component from './utils/component';
 
 export default class Subtitle extends Component {
@@ -39,7 +39,7 @@ export default class Subtitle extends Component {
         if (this.activeCue) {
             $subtitle.innerHTML = this.activeCue.text
                 .split(/\r?\n/)
-                .map(item => `<p>${item}</p>`)
+                .map(item => `<p>${escape(item)}</p>`)
                 .join('');
             this.art.emit('subtitle:update', this.activeCue.text);
         }

packages/artplayer/src/utils/format.js

@@ -9,3 +9,17 @@ export function secondToTime(second) {
     const sec = Math.floor(second - hour * 3600 - min * 60);
     return (hour > 0 ? [hour, min, sec] : [min, sec]).map(add0).join(':');
 }
+
+export function escape(str) {
+    return str.replace(
+        /[&<>'"]/g,
+        tag =>
+            ({
+                '&': '&amp;',
+                '<': '&lt;',
+                '>': '&gt;',
+                "'": '&#39;',
+                '"': '&quot;',
+            }[tag] || tag),
+    );
+}