google / google/guice

GraphvizGrapher.getNodeLabel doesn't htmlEscape subtitle, possible invalid <table> HTML if subtitle contains invalid characters (e.g. '<', '>', etc)

Open
#1,837 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
12.7k
Forks
1.7k
Avg merge
11m
Merged PRs (30d)
2

Description

We ran into an edge case where `node.getSubtitles()` returns a string that contains unsafe HTML characters such as '<' and '>'. For context, the subtitle contains Java type angle brackets (e.g. Foo).

This resulted in errors when compiling the `.dot` file.

A possible fix might be to `htmlEscape(subtitle)` before appending it to the `StringBuilder html`: https://github.com/google/guice/blob/master/extensions/grapher/src/com/google/inject/grapher/graphviz/GraphvizGrapher.java#L148

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.