GraphvizGrapher.getNodeLabel doesn't htmlEscape subtitle, possible invalid <table> HTML if subtitle contains invalid characters (e.g. '<', '>', etc)
Open
- Dominant language
- Java
- Stars
- 12.7k
- Forks
- 1.7k
- Avg merge
- 11m
- Merged PRs (30d)
- 2
Description
We ran into an edge case where `node.getSubtitles()` returns a string that contains unsafe HTML characters such as '<' and '>'. For context, the subtitle contains Java type angle brackets (e.g. Foo).
This resulted in errors when compiling the `.dot` file.
A possible fix might be to `htmlEscape(subtitle)` before appending it to the `StringBuilder html`: https://github.com/google/guice/blob/master/extensions/grapher/src/com/google/inject/grapher/graphviz/GraphvizGrapher.java#L148
Contributor guide
Assessment
This issue has not been assessed yet.