From c9e77b98dd01c20c3bd1178ed4fe1bf18ede862e Mon Sep 17 00:00:00 2001
From: Rasmus Kuschel <rasmushofmann@gmail.com>
Date: Sun, 22 Dec 2024 15:47:50 +0100
Subject: [PATCH] Ensure HTML is properly escaped for all user-provided text
 properties (#3585)

---
 .../src/main/resources/freemarker/home.ftl                    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/serenity-report-resources/src/main/resources/freemarker/home.ftl b/serenity-report-resources/src/main/resources/freemarker/home.ftl
index fd63a8d1f..cad56cb6b 100644
--- a/serenity-report-resources/src/main/resources/freemarker/home.ftl
+++ b/serenity-report-resources/src/main/resources/freemarker/home.ftl
@@ -528,7 +528,7 @@
                                                                         <td>${context_icon}<span style="display:none">${context_label}</span>
                                                                         </td>
                                                                         <td>${scenario.stepCount}</td>
-                                                                        <td>${scenario.allStepsText}</td>
+                                                                        <td><#outputformat 'HTML'>${scenario.allStepsText}</#outputformat></td>
                                                                         <td data-order="${scenario.timestamp}">${scenario.formattedStartTime}</td>
                                                                         <td>${scenario.formattedDuration}</td>
                                                                         <td>${outcome_icon} <span
@@ -658,7 +658,7 @@
                                                                 <#list evidence as evidenceRecord>
                                                                     <tr>
                                                                         <td>${evidenceRecord.scenario}</td>
-                                                                        <td>${evidenceRecord.title}</td>
+                                                                        <td><#outputformat 'HTML'>${evidenceRecord.title}</#outputformat></td>
                                                                         <td>${evidenceRecord.detailsLink}</td>
                                                                     </tr>
                                                                 </#list>