html: Fix example blocks - escape html

While example blocks do not render inline markup and are thus parsed raw in
some way, their contents are not literal html and thus still need to be html
escaped.

org/html_writer.go

@@ -123,7 +123,7 @@ func (w *HTMLWriter) WriteBlock(b Block) {
 		content = w.HighlightCodeBlock(content, lang)
 		w.WriteString(fmt.Sprintf("<div class=\"src src-%s\">\n%s\n</div>\n", lang, content))
 	case name == "EXAMPLE":
-		w.WriteString(`<pre class="example">` + "\n" + content + "\n</pre>\n")
+		w.WriteString(`<pre class="example">` + "\n" + html.EscapeString(content) + "\n</pre>\n")
 	case name == "EXPORT" && len(b.Parameters) >= 1 && strings.ToLower(b.Parameters[0]) == "html":
 		w.WriteString(content + "\n")
 	case name == "QUOTE":

org/testdata/blocks.html

@@ -32,9 +32,11 @@ empty lines!
 
 it also has multiple parameters
 
-src, example & export blocks treat their content as raw text
+src, example & export blocks treat their content as raw text
 /inline/ *markup* is ignored
       and whitespace is honored and not removed
+
+content of example blocks is still html escaped - see <script>alert("escaped")</script>
 </pre>
 <pre class="example">
 examples like this

org/testdata/blocks.org

@@ -25,6 +25,8 @@ it also has multiple parameters
 src, example & export blocks treat their content as raw text
 /inline/ *markup* is ignored
       and whitespace is honored and not removed
+
+content of example blocks is still html escaped - see <script>alert("escaped")</script>
 #+END_EXAMPLE
 
 : examples like this

org/testdata/blocks.pretty_org

@@ -25,6 +25,8 @@ it also has multiple parameters
 src, example & export blocks treat their content as raw text
 /inline/ *markup* is ignored
       and whitespace is honored and not removed
+
+content of example blocks is still html escaped - see <script>alert("escaped")</script>
 #+END_EXAMPLE
 
 : examples like this

org/testdata/misc.html

@@ -200,7 +200,7 @@ example block
 </p>
 <pre class="example">
 language: go
-go: "1.x"
+go: &#34;1.x&#34;
 script:
   - make test
   - make generate-gh-pages