feat(ai-scribe): Fix missing HTML entity escaping creates correctness and potential security issues

2025-12-19 13:12:27 +07:00
parent c78f6b8a76
commit b3dd6a9e85
1 changed files with 9 additions and 1 deletions
@@ -216,7 +216,15 @@ class StringConvert {
  }

  static String convertTextContentToHtmlContent(String textContent) {
-    final htmlContent = textContent.replaceAll('\n', '<br>');
+    // Escape HTML entities first to prevent interpretation as HTML
+    final escapedContent = textContent
+        .replaceAll('&', '&amp;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+
+    final htmlContent = escapedContent.replaceAll('\n', '<br>');

    return '<div>$htmlContent</div>';
  }