From b3dd6a9e852ec74c8e92d80bd3c99969fbe2ee7c Mon Sep 17 00:00:00 2001
From: dab246 <tdvu@linagora.com>
Date: Fri, 19 Dec 2025 13:12:27 +0700
Subject: [PATCH] feat(ai-scribe): Fix missing HTML entity escaping creates
 correctness and potential security issues

---
 core/lib/utils/string_convert.dart | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/core/lib/utils/string_convert.dart b/core/lib/utils/string_convert.dart
index a959aeacb..8e1b7b75a 100644
--- a/core/lib/utils/string_convert.dart
+++ b/core/lib/utils/string_convert.dart
@@ -216,7 +216,15 @@ class StringConvert {
   }
 
   static String convertTextContentToHtmlContent(String textContent) {
-    final htmlContent = textContent.replaceAll('\n', '<br>');
+    // Escape HTML entities first to prevent interpretation as HTML
+    final escapedContent = textContent
+        .replaceAll('&', '&amp;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;');
+
+    final htmlContent = escapedContent.replaceAll('\n', '<br>');
 
     return '<div>$htmlContent</div>';
   }