Ensure HTML is properly escaped for all user-provided text properties (…

…#3585)
serenity-bdd · Dec 22, 2024 · c9e77b9 · c9e77b9
1 parent 3f31306
commit c9e77b9
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/serenity-report-resources/src/main/resources/freemarker/home.ftl b/serenity-report-resources/src/main/resources/freemarker/home.ftl
@@ -528,7 +528,7 @@
                                                                         <td>${context_icon}<span style="display:none">${context_label}</span>
                                                                         </td>
                                                                         <td>${scenario.stepCount}</td>
-                                                                        <td>${scenario.allStepsText}</td>
+                                                                        <td><#outputformat 'HTML'>${scenario.allStepsText}</#outputformat></td>
                                                                         <td data-order="${scenario.timestamp}">${scenario.formattedStartTime}</td>
                                                                         <td>${scenario.formattedDuration}</td>
                                                                         <td>${outcome_icon} <span
@@ -658,7 +658,7 @@
                                                                 <#list evidence as evidenceRecord>
                                                                     <tr>
                                                                         <td>${evidenceRecord.scenario}</td>
-                                                                        <td>${evidenceRecord.title}</td>
+                                                                        <td><#outputformat 'HTML'>${evidenceRecord.title}</#outputformat></td>
                                                                         <td>${evidenceRecord.detailsLink}</td>
                                                                     </tr>
                                                                 </#list>