Fix XSS in Handling Text Block.

Vulnerable to a notebook like:

{
  "cells": [{
    "cell_type": "code",
    "source": [],
    "outputs": [{
      "output_type": "display_data",
      "data": {
        "text/plain": "<img src onerror=\"alert('XSS at '+origin)\">"
      }
    }]
  }]
}

Author: Roman Stoffel

notebook.js

@@ -111,7 +111,7 @@
     nb.display = {};
     nb.display.text = function (text) {
         var el = makeElement("pre", [ "text-output" ]);
-        el.innerHTML = nb.highlighter(nb.ansi(joinText(text)), el);
+        el.innerHTML = nb.sanitizer(nb.highlighter(nb.ansi(joinText(text)), el));
         return el;
     };
     nb.display["text/plain"] = nb.display.text;