White space replacement: Escape '<>&' before setting innerHTML, v2.1.1

Setting the innerHTML attribute of the node is necessary when we replace
the white spaces by alternative characters, because we need the spans to
be interpreted to set “comment”-style (font color) for those characters.

But if we omit to escape HTML special characters, they get interpreted
in the process! Let's escape them before replacing the white spaces.

Increment version to v2.1.1, for releasing the fix

Fixes: #99
Reported-by: @iiey

manifest.json

@@ -7,7 +7,7 @@
     }
   },
   "name": "Colored Diffs",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Color diffs in messages formatted by Git or other version control systems",
   "author": "Vadim Atlygin",
   "homepage_url": "https://github.com/Qeole/colorediffs",

scripts/transformations.js

@@ -31,6 +31,9 @@ function replaceSpaces(root, tabsize) {
     };
 
     function doReplace(node) {
+        node.textContent = node.textContent.replace(/&/g,'&')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;');
         node.innerHTML = node.textContent.replace(/( +|\t+)/g, replacer);
     };