How to not render html

[olivierberten]

I'd like to use your tool with some json files containing html code. But I'd like to see the code as code rather than rendered html. Is this currently possible ?

[kodiful]

Replacing
<div class="json-value json-${r}">${t}</div>
with
<div class="json-value json-${r}">${String(t).replace('>','&gt;').replace('<','&lt;')}</div>
seems to work.

[davtur19]

This is a serious problem of the library that does not do any kind of escape, the solution proposed by @kodiful is not a safe workaround.

Not all the necessary escapes have been made

.replace(/&/g, "&")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#039;")

This bug needs to be fixed in the library and can lead to severe xss