fix(pastes): sanitize paste content while rendering

Signed-off-by: SphericalKat <amolele@gmail.com>

lib/ketbin_web/controllers/page_controller.ex

@@ -30,7 +30,7 @@ defmodule KetbinWeb.PageController do
   def showlink(%{assigns: %{show_edit: show_edit}} = conn, %{"id" => id}) do
     [head | tail] = String.split(id, ".")
     paste = Pastes.get_paste!(head)
-    render(conn, "show.html", paste: paste, show_edit: show_edit, extension: List.first(tail) || "")
+    render(conn, "show.html", paste: paste, show_edit: show_edit, extension: (if tail == [], do: "", else: tail))
   end
 
   def raw(conn, %{"id" => id}) do

lib/ketbin_web/templates/page/show.html.eex

@@ -8,5 +8,5 @@
 		</a>
 		<% end %>
 	</div>
-	<code class="break-word px-6 py-4 h-full w-full nomarkdown overflow-y-auto"><%= raw Ketbin.Utils.Syntax.highlight_text(@paste.content, @extension) %></code>
+	<code class="break-word px-6 py-4 h-full w-full nomarkdown overflow-y-auto"><%= raw Ketbin.Utils.Syntax.highlight_text(@paste.content, @extension) |> HtmlSanitizeEx.html5 %></code>
 </div>