diff --git a/CHANGELOG.md b/CHANGELOG.md index b364f989f..d1017bd3a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file. ## Unreleased +### Fixed + +- Fix HTML entities displaying incorrectly in PDF exports (e.g., "&" showing as "&") + ## [0.78.0] - 2025-10-23 ### Added diff --git a/pkg/docgen/generator.go b/pkg/docgen/generator.go index 021a8955e..6f4b68ec9 100644 --- a/pkg/docgen/generator.go +++ b/pkg/docgen/generator.go @@ -92,14 +92,6 @@ const ( ) func RenderHTML(data DocumentData) ([]byte, error) { - data.Title = html.EscapeString(data.Title) - data.Approver = html.EscapeString(data.Approver) - data.Description = html.EscapeString(data.Description) - - for i := range data.Signatures { - data.Signatures[i].SignedBy = html.EscapeString(data.Signatures[i].SignedBy) - } - var buf bytes.Buffer if err := documentTemplate.Execute(&buf, data); err != nil { return nil, fmt.Errorf("failed to execute template: %w", err) diff --git a/pkg/docgen/generator_test.go b/pkg/docgen/generator_test.go index 5586b76c0..0ca6ca1cd 100644 --- a/pkg/docgen/generator_test.go +++ b/pkg/docgen/generator_test.go @@ -77,9 +77,9 @@ func TestRenderHTML(t *testing.T) { }, }, wantContains: []string{ - "Test &amp; &lt;Script&gt; Title", - "John &lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt; Doe", - "Alice &amp; &lt;Bob&gt;", + "Test & <Script> Title", + "John <script>alert('xss')</script> Doe", + "Alice & <Bob>", }, wantNotContains: []string{ "", @@ -266,12 +266,12 @@ func TestHTMLEscaping(t *testing.T) { resultStr := string(result) - // Verify dangerous content is escaped + // Verify dangerous content is escaped assert.NotContains(t, resultStr, "") assert.NotContains(t, resultStr, "tag") - assert.Contains(t, resultStr, "&lt;script&gt;") - assert.Contains(t, resultStr, "&amp;") - assert.Contains(t, resultStr, "&#39;") + assert.Contains(t, resultStr, "<script>") + assert.Contains(t, resultStr, "&") + assert.Contains(t, resultStr, "'") } func TestMarkdownRendering(t *testing.T) {