TF-3349 Escape messages when forward and reply email

core/lib/presentation/extensions/html_extension.dart

@@ -1,4 +1,6 @@
 
+import 'dart:convert';
+
 extension HtmlExtension on String {
 
   static const String editorStartTags = '<div><br><br></div>';
@@ -40,4 +42,19 @@ extension HtmlExtension on String {
     'cite',
     attribute: 'style="text-align: left;display: block;"'
   );
+}
+
+extension HtmlNullableExtension on String? {
+  String escapeHtmlString({HtmlEscapeMode escapeMode = HtmlEscapeMode.unknown}) {
+    try {
+      if (this?.trim().isNotEmpty != true) return '';
+
+      return HtmlEscape(escapeMode).convert(this!);
+    } catch (e) {
+      return '';
+    }
+  }
+
+  String escapeLtGtHtmlString() =>
+      escapeHtmlString(escapeMode: HtmlEscapeMode.element);
 }

core/test/presentation/extensions/html_extension_test.dart

@@ -0,0 +1,36 @@
+import 'package:core/presentation/extensions/html_extension.dart';
+import 'package:flutter_test/flutter_test.dart';
+
+void main() {
+  group('HtmlNullableExtension::', () {
+    test('escapeHtmlString should escapes HTML containing onclick attribute', () {
+      String? input = "<a onclick=\"alert('hi')\">Click</a>";
+      expect(input.escapeHtmlString(),
+          '&lt;a onclick=&quot;alert(&#39;hi&#39;)&quot;&gt;Click&lt;&#47;a&gt;');
+    });
+
+    test('escapeHtmlString should escapes HTML containing multiple events', () {
+      String? input = "<div onmouseover=\"alert('hover')\" onclick=\"doSomething()\">Hover</div>";
+      expect(input.escapeHtmlString(),
+          '&lt;div onmouseover=&quot;alert(&#39;hover&#39;)&quot; onclick=&quot;doSomething()&quot;&gt;Hover&lt;&#47;div&gt;');
+    });
+
+    test('escapeLtGtHtmlString should escapes only < and > with events', () {
+      String? input = "<button onclick=\"run()\">Run</button>";
+      expect(input.escapeLtGtHtmlString(),
+          '&lt;button onclick=\"run()\"&gt;Run&lt;/button&gt;');
+    });
+
+    test('escapeHtmlString should handles HTML with empty event attributes', () {
+      String? input = "<img src=\"image.png\" onerror=\"\">";
+      expect(input.escapeHtmlString(),
+          '&lt;img src=&quot;image.png&quot; onerror=&quot;&quot;&gt;');
+    });
+
+    test('escapeHtmlString should handles HTML with invalid syntax in events', () {
+      String? input = "<a onclick=\"alert('unclosed event)>Click</a>";
+      expect(input.escapeHtmlString(),
+          '&lt;a onclick=&quot;alert(&#39;unclosed event)&gt;Click&lt;&#47;a&gt;');
+    });
+  });
+}