Currently, the `config` in the codeState in the hash is sanitized for
unsafe values, however the `?config` URL parameter or configs loaded
from a GitHub Gist are not.
Reported-by: Chai Cheng Xun @QiaoNPC
Use the `<output>` and `<pre>` HTML elements to format mermaid errors,
instead just adding the error message as HTML.
Using `<pre>` avoids the need for sanitizing any HTML (or using a
`monospace` font in CSS, since `<pre>` does this automatically).
Using `<output>` means that users using screenreaders should have a
better experience when using the mermaid live editor.
on-behalf-of: @Mermaid-Chart <hello@mermaidchart.com>
Alois Klink