Skip to content

gh-153840: Escape special characters in flamegraph function names#153841

Open
tonghuaroot wants to merge 2 commits into
python:mainfrom
tonghuaroot:flamegraph-escape-funcname
Open

gh-153840: Escape special characters in flamegraph function names#153841
tonghuaroot wants to merge 2 commits into
python:mainfrom
tonghuaroot:flamegraph-escape-funcname

Conversation

@tonghuaroot

@tonghuaroot tonghuaroot commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Escape <, >, & as < etc. in the embedded JSON blob to prevent </script> breakout, and wrap the tooltip function name with the existing escapeHtml() helper. The sibling heatmap exporter and the flamegraph's own displayName already escape; the function name was missed.

@eendebakpt

Copy link
Copy Markdown
Contributor

Looks ok. Can you add tests?

@tonghuaroot

Copy link
Copy Markdown
Contributor Author

Added a test that verifies </script> in a function name does not appear unescaped in the output.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants