From 40030fe88e7dd3dae527210237be195e69ffa63d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9o=20Poizat?= <hello@zatteo.com>
Date: Tue, 27 Jan 2026 11:21:10 +0100
Subject: [PATCH] Properly escape HTML in every Scribe actions

In recent commits I separated how we could add text in the editor. So
we need to escape HTML in both method that add text:
insertTextInEditor and setTextInEditor.

I had to extract the HTML escape part of
convertTextContentToHtmlContent because when using setTextInEditor we
do not need to convert \n to <br>.
---
 core/lib/utils/string_convert.dart               | 16 +++++++---------
 .../handle_ai_scribe_in_composer_extension.dart  | 11 +++++++----
 2 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/core/lib/utils/string_convert.dart b/core/lib/utils/string_convert.dart
index b9ab697c3..51d9700b5 100644
--- a/core/lib/utils/string_convert.dart
+++ b/core/lib/utils/string_convert.dart
@@ -251,16 +251,14 @@ class StringConvert {
     }
   }
 
-  static String convertTextContentToHtmlContent(String textContent) {
-    // Escape HTML entities first to prevent interpretation as HTML
-    final escapedContent = textContent
-        .replaceAll('&', '&amp;')
-        .replaceAll('<', '&lt;')
-        .replaceAll('>', '&gt;')
-        .replaceAll('"', '&quot;')
-        .replaceAll("'", '&#39;');
+  static String escapeTextContent(String textContent) {
+    const HtmlEscape htmlEscape = HtmlEscape();
 
-    final htmlContent = escapedContent.replaceAll('\n', '<br>');
+    return htmlEscape.convert(textContent);
+  }
+
+  static String convertTextContentToHtmlContent(String textContent) {
+    final htmlContent = textContent.replaceAll('\n', '<br>');
 
     return '<div>$htmlContent</div>';
   }
diff --git a/lib/features/composer/presentation/extensions/ai_scribe/handle_ai_scribe_in_composer_extension.dart b/lib/features/composer/presentation/extensions/ai_scribe/handle_ai_scribe_in_composer_extension.dart
index fad7592f0..5f157fd24 100644
--- a/lib/features/composer/presentation/extensions/ai_scribe/handle_ai_scribe_in_composer_extension.dart
+++ b/lib/features/composer/presentation/extensions/ai_scribe/handle_ai_scribe_in_composer_extension.dart
@@ -36,7 +36,8 @@ extension HandleAiScribeInComposerExtension on ComposerController {
 
   Future<void> insertTextInEditor(String text) async {    
     try {
-      final htmlContent = StringConvert.convertTextContentToHtmlContent(text);
+      final escapedText = StringConvert.escapeTextContent(text);
+      final htmlContent = StringConvert.convertTextContentToHtmlContent(escapedText);
 
       if (PlatformInfo.isWeb) {
         await richTextWebController?.editorController.evaluateJavascriptWeb(
@@ -55,13 +56,15 @@ extension HandleAiScribeInComposerExtension on ComposerController {
 
   Future<void> setTextInEditor(String text) async {
     try {
+      final escapedText = StringConvert.escapeTextContent(text);
+      
       if (PlatformInfo.isWeb) {
-        richTextWebController?.editorController.setText(text);
+        richTextWebController?.editorController.setText(escapedText);
       } else {
-        await richTextMobileTabletController?.htmlEditorApi?.setText(text);
+        await richTextMobileTabletController?.htmlEditorApi?.setText(escapedText);
       }
     } catch (e) {
-      logWarning('$runtimeType::insertTextInEditor:Exception = $e');
+      logWarning('$runtimeType::setTextInEditor:Exception = $e');
     }
   }