diff --git a/CHANGELOG.md b/CHANGELOG.md
index b364f989f..d1017bd3a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
## Unreleased
+### Fixed
+
+- Fix HTML entities displaying incorrectly in PDF exports (e.g., "&" showing as "&")
+
## [0.78.0] - 2025-10-23
### Added
diff --git a/pkg/docgen/generator.go b/pkg/docgen/generator.go
index 021a8955e..6f4b68ec9 100644
--- a/pkg/docgen/generator.go
+++ b/pkg/docgen/generator.go
@@ -92,14 +92,6 @@ const (
)
func RenderHTML(data DocumentData) ([]byte, error) {
- data.Title = html.EscapeString(data.Title)
- data.Approver = html.EscapeString(data.Approver)
- data.Description = html.EscapeString(data.Description)
-
- for i := range data.Signatures {
- data.Signatures[i].SignedBy = html.EscapeString(data.Signatures[i].SignedBy)
- }
-
var buf bytes.Buffer
if err := documentTemplate.Execute(&buf, data); err != nil {
return nil, fmt.Errorf("failed to execute template: %w", err)
diff --git a/pkg/docgen/generator_test.go b/pkg/docgen/generator_test.go
index 5586b76c0..0ca6ca1cd 100644
--- a/pkg/docgen/generator_test.go
+++ b/pkg/docgen/generator_test.go
@@ -77,9 +77,9 @@ func TestRenderHTML(t *testing.T) {
},
},
wantContains: []string{
- "Test & <Script> Title",
- "John <script>alert('xss')</script> Doe",
- "Alice & <Bob>",
+ "Test & <Script> Title",
+ "John <script>alert('xss')</script> Doe",
+ "Alice & <Bob>",
},
wantNotContains: []string{
"",
@@ -266,12 +266,12 @@ func TestHTMLEscaping(t *testing.T) {
resultStr := string(result)
- // Verify dangerous content is escaped
+ // Verify dangerous content is escaped
assert.NotContains(t, resultStr, "")
assert.NotContains(t, resultStr, "tag")
- assert.Contains(t, resultStr, "<script>")
- assert.Contains(t, resultStr, "&")
- assert.Contains(t, resultStr, "'")
+ assert.Contains(t, resultStr, "<script>")
+ assert.Contains(t, resultStr, "&")
+ assert.Contains(t, resultStr, "'")
}
func TestMarkdownRendering(t *testing.T) {