Fix HTML entities displaying incorrectly in PDF exports

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 
 ## Unreleased
 
+### Fixed
+
+- Fix HTML entities displaying incorrectly in PDF exports (e.g., "&" showing as "&")
+
 ## [0.78.0] - 2025-10-23
 
 ### Added

pkg/docgen/generator.go

@@ -92,14 +92,6 @@ const (
 )
 
 func RenderHTML(data DocumentData) ([]byte, error) {
-	data.Title = html.EscapeString(data.Title)
-	data.Approver = html.EscapeString(data.Approver)
-	data.Description = html.EscapeString(data.Description)
-
-	for i := range data.Signatures {
-		data.Signatures[i].SignedBy = html.EscapeString(data.Signatures[i].SignedBy)
-	}
-
 	var buf bytes.Buffer
 	if err := documentTemplate.Execute(&buf, data); err != nil {
 		return nil, fmt.Errorf("failed to execute template: %w", err)

pkg/docgen/generator_test.go

@@ -77,9 +77,9 @@ func TestRenderHTML(t *testing.T) {
 				},
 			},
 			wantContains: []string{
-				"Test & <Script> Title",
-				"John <script>alert('xss')</script> Doe",
-				"Alice & <Bob>",
+				"Test & <Script> Title",
+				"John <script>alert('xss')</script> Doe",
+				"Alice & <Bob>",
 			},
 			wantNotContains: []string{
 				"<script>alert('xss')</script>",
@@ -266,12 +266,12 @@ func TestHTMLEscaping(t *testing.T) {
 
 	resultStr := string(result)
 
-	// Verify dangerous content is escaped
+	// Verify dangerous content is escaped 
 	assert.NotContains(t, resultStr, "<script>alert('xss')</script>")
 	assert.NotContains(t, resultStr, "<malicious>tag")
-	assert.Contains(t, resultStr, "&amp;lt;script&amp;gt;")
-	assert.Contains(t, resultStr, "&amp;amp;")
-	assert.Contains(t, resultStr, "&amp;#39;")
+	assert.Contains(t, resultStr, "&lt;script&gt;")
+	assert.Contains(t, resultStr, "&amp;")
+	assert.Contains(t, resultStr, "&#39;")
 }
 
 func TestMarkdownRendering(t *testing.T) {