build: sanitize parsed comments

Adds some logic to avoid accidental HTML injection through the Markdown renderer.

(cherry picked from commit 60262dc)

Author: crisbeto

tools/markdown-to-html/docs-marked-renderer.mts

@@ -102,11 +102,11 @@ export class DocsMarkdownRenderer extends Renderer {
           file: string;
           region: string;
         };
-        replacement = `<div material-docs-example="${example}"
-                             ${file ? `file="${file}"` : ''}
-                             ${region ? `region="${region}"` : ''}></div>`;
+        replacement = `<div material-docs-example="${this._escapeHtml(example)}"
+                             ${file ? `file="${this._escapeHtml(file)}"` : ''}
+                             ${region ? `region="${this._escapeHtml(region)}"` : ''}></div>`;
       } else {
-        replacement = `<div material-docs-example="${content}"></div>`;
+        replacement = `<div material-docs-example="${this._escapeHtml(content)}"></div>`;
       }
 
       return `${exampleStartMarker}${replacement}${exampleEndMarker}`;
@@ -154,4 +154,17 @@ export class DocsMarkdownRenderer extends Renderer {
 
     return `${markdownOpen}${output}</div>`;
   }
+
+  private _escapeHtml(text: string): string {
+    if (!text) {
+      return text;
+    }
+
+    return text
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&#39;');
+  }
 }