diff --git a/core/lib/utils/string_convert.dart b/core/lib/utils/string_convert.dart index b9ab697c3..51d9700b5 100644 --- a/core/lib/utils/string_convert.dart +++ b/core/lib/utils/string_convert.dart @@ -251,16 +251,14 @@ class StringConvert { } } - static String convertTextContentToHtmlContent(String textContent) { - // Escape HTML entities first to prevent interpretation as HTML - final escapedContent = textContent - .replaceAll('&', '&') - .replaceAll('<', '<') - .replaceAll('>', '>') - .replaceAll('"', '"') - .replaceAll("'", '''); + static String escapeTextContent(String textContent) { + const HtmlEscape htmlEscape = HtmlEscape(); - final htmlContent = escapedContent.replaceAll('\n', '
'); + return htmlEscape.convert(textContent); + } + + static String convertTextContentToHtmlContent(String textContent) { + final htmlContent = textContent.replaceAll('\n', '
'); return '
$htmlContent
'; } diff --git a/lib/features/composer/presentation/extensions/ai_scribe/handle_ai_scribe_in_composer_extension.dart b/lib/features/composer/presentation/extensions/ai_scribe/handle_ai_scribe_in_composer_extension.dart index fad7592f0..5f157fd24 100644 --- a/lib/features/composer/presentation/extensions/ai_scribe/handle_ai_scribe_in_composer_extension.dart +++ b/lib/features/composer/presentation/extensions/ai_scribe/handle_ai_scribe_in_composer_extension.dart @@ -36,7 +36,8 @@ extension HandleAiScribeInComposerExtension on ComposerController { Future insertTextInEditor(String text) async { try { - final htmlContent = StringConvert.convertTextContentToHtmlContent(text); + final escapedText = StringConvert.escapeTextContent(text); + final htmlContent = StringConvert.convertTextContentToHtmlContent(escapedText); if (PlatformInfo.isWeb) { await richTextWebController?.editorController.evaluateJavascriptWeb( @@ -55,13 +56,15 @@ extension HandleAiScribeInComposerExtension on ComposerController { Future setTextInEditor(String text) async { try { + final escapedText = StringConvert.escapeTextContent(text); + if (PlatformInfo.isWeb) { - richTextWebController?.editorController.setText(text); + richTextWebController?.editorController.setText(escapedText); } else { - await richTextMobileTabletController?.htmlEditorApi?.setText(text); + await richTextMobileTabletController?.htmlEditorApi?.setText(escapedText); } } catch (e) { - logWarning('$runtimeType::insertTextInEditor:Exception = $e'); + logWarning('$runtimeType::setTextInEditor:Exception = $e'); } }