Properly escape HTML in every Scribe actions

In recent commits I separated how we could add text in the editor. So
we need to escape HTML in both method that add text:
insertTextInEditor and setTextInEditor.

I had to extract the HTML escape part of
convertTextContentToHtmlContent because when using setTextInEditor we
do not need to convert \n to <br>.
This commit is contained in:
Théo Poizat
2026-01-27 11:21:10 +01:00
committed by Dat H. Pham
parent cf8ed16ed0
commit 40030fe88e
2 changed files with 14 additions and 13 deletions
+7 -9
View File
@@ -251,16 +251,14 @@ class StringConvert {
}
}
static String convertTextContentToHtmlContent(String textContent) {
// Escape HTML entities first to prevent interpretation as HTML
final escapedContent = textContent
.replaceAll('&', '&amp;')
.replaceAll('<', '&lt;')
.replaceAll('>', '&gt;')
.replaceAll('"', '&quot;')
.replaceAll("'", '&#39;');
static String escapeTextContent(String textContent) {
const HtmlEscape htmlEscape = HtmlEscape();
final htmlContent = escapedContent.replaceAll('\n', '<br>');
return htmlEscape.convert(textContent);
}
static String convertTextContentToHtmlContent(String textContent) {
final htmlContent = textContent.replaceAll('\n', '<br>');
return '<div>$htmlContent</div>';
}