KaykCaputo · KaykCaputo · Jul 9, 2026 · Jul 9, 2026 · Jul 9, 2026
diff --git a/oracletrace/reporters/html.py b/oracletrace/reporters/html.py
@@ -1,5 +1,6 @@
 import json
 from datetime import datetime
+from html import escape
 from string import Template
 from typing import List
 from ..tracer import TracerData, FunctionData
@@ -15,7 +16,7 @@ def generate_html_report(data: TracerData, output_path: str) -> None:
     timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
 
     html = _JSTemplate(_HTML_TEMPLATE).substitute(
-        root_path=metadata.root_path,
+        root_path=escape(metadata.root_path),
         total_time=f"{metadata.total_execution_time:.4f}s",
         total_functions=str(metadata.total_functions),
         timestamp=timestamp,
@@ -36,7 +37,9 @@ def _serialize_functions(functions: List[FunctionData]) -> str:
             "avg_time": fn.avg_time * 1000,
             "callees": fn.callees,
         })
-    return json.dumps(serialized)
+    # < keeps a literal "</script>" in a function name from terminating
+    # the inline <script> block at parse time
+    return json.dumps(serialized).replace("<", "\\u003c")
 
 
 _HTML_TEMPLATE = '''<!DOCTYPE html>
@@ -216,6 +219,11 @@ def _serialize_functions(functions: List[FunctionData]) -> str:
         let sortDir = "desc";
         let searchTerm = "";
 
+        function esc(s) {
+            return String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;")
+                .replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+        }
+
         function render() {
             const filtered = functions.filter(f =>
                 f.name.toLowerCase().includes(searchTerm.toLowerCase())
@@ -232,11 +240,11 @@ def _serialize_functions(functions: List[FunctionData]) -> str:
             const tbody = document.getElementById("table-body");
             tbody.innerHTML = filtered.map(f => `
                 <tr>
-                    <td>${f.name}</td>
+                    <td>${esc(f.name)}</td>
                     <td>${f.total_time.toFixed(4)}</td>
                     <td>${f.call_count}</td>
                     <td>${f.avg_time.toFixed(4)}</td>
-                    <td class="callee">${f.callees.join(", ")}</td>
+                    <td class="callee">${f.callees.map(esc).join(", ")}</td>
                 </tr>
             `).join("");
 

diff --git a/tests/test_html_reporter.py b/tests/test_html_reporter.py
@@ -123,3 +123,45 @@ def test_html_report_empty_functions(sample_trace_data, tmp_path):
 
     assert "[]" in content
     assert "/empty" in content
+
+
+def test_script_breakout_in_function_name_is_neutralized(tmp_path):
+    data = TracerData(
+        metadata=TracerMetadata(
+            root_path="/test/project", total_functions=1, total_execution_time=1.0
+        ),
+        functions=[
+            FunctionData(
+                name='evil.py:</script><script>alert(1)</script>',
+                total_time=1.0,
+                call_count=1,
+                avg_time=1.0,
+                callees=['evil.py:</script><img src=x onerror=alert(2)>'],
+            )
+        ],
+    )
+    output = tmp_path / "report.html"
+    generate_html_report(data, str(output))
+    html = output.read_text(encoding="utf-8")
+
+    # a literal </script> inside the embedded JSON would terminate the
+    # report's own script block at parse time
+    assert "<script>alert(1)</script>" not in html
+    assert "<img src=x onerror" not in html
+    assert "\u003c/script" in html  # payload survives, JSON-escaped
+
+
+def test_root_path_is_html_escaped(tmp_path):
+    data = TracerData(
+        metadata=TracerMetadata(
+            root_path='/proj/<img src=x onerror=alert(3)>',
+            total_functions=0,
+            total_execution_time=0.0,
+        ),
+        functions=[],
+    )
+    output = tmp_path / "report.html"
+    generate_html_report(data, str(output))
+    html = output.read_text(encoding="utf-8")
+    assert "<img src=x onerror=alert(3)>" not in html
+    assert "&lt;img" in html