report output html: escape &, <, > from the source C-files to HTML-ou…

…tput. Close Ericsson#3748
dilyanpalauzov · Oct 15, 2022 · c40a25a · c40a25a
1 parent 96db6ec
commit c40a25a
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/tools/report-converter/codechecker_report_converter/report/output/html/html.py b/tools/report-converter/codechecker_report_converter/report/output/html/html.py
@@ -6,6 +6,7 @@
 #
 # -------------------------------------------------------------------------
 
+import html
 import io
 import json
 import logging
@@ -171,7 +172,7 @@ def _add_source_file(self, file: File) -> FileSource:
             file_content = InvalidFileContentMsg
 
         self.files[file.id] = {
-            'id': file.id, 'filePath': file.path, 'content': file_content}
+            'id': file.id, 'filePath': file.path, 'content': html.escape(file_content)}
 
         return self.files[file.id]
 

diff --git a/...s/report-converter/codechecker_report_converter/report/output/html/static/js/bugviewer.js b/...s/report-converter/codechecker_report_converter/report/output/html/static/js/bugviewer.js
@@ -195,7 +195,9 @@ var BugViewer = {
 
     this._sourceFileData = file;
     this._filepath.innerHTML = file.filePath;
-    this._codeMirror.doc.setValue(file.content);
+    let e = document.createElement('div');
+    e.innerHTML = file.content;
+    this._codeMirror.doc.setValue(e.innerText);
     this._refresh();
   },