fix(export-html): escape quotes in exported attributes

closes #4832
2026-05-22 15:47:57 +02:00
parent 60e2e4332d
commit b3ed545938
2 changed files with 7 additions and 3 deletions
--- a/packages/coding-agent/src/core/export-html/template.js
+++ b/packages/coding-agent/src/core/export-html/template.js
@@ -605,9 +605,12 @@
      }

      function escapeHtml(text) {
-        const div = document.createElement('div');
-        div.textContent = text;
-        return div.innerHTML;
+        return String(text)
+          .replace(/&/g, '&amp;')
+          .replace(/</g, '&lt;')
+          .replace(/>/g, '&gt;')
+          .replace(/"/g, '&quot;')
+          .replace(/'/g, '&#39;');
      }

      /**