Escape HTML in tooltips to prevent angle brackets being interpreted as tags

[Copilot]

Description

Tooltips containing Rust generic types like Table<Vector<Option<Table<Graphic>>>> were being interpreted as HTML tags due to the {@html} directive in Tooltip.svelte. The angle brackets caused the browser to attempt parsing them as elements, resulting in broken tooltip display.

Changes

frontend/src/components/floating-menus/Tooltip.svelte:

• Added escapeHtml() function to escape <, >, &, ", ' characters
• Modified parseMarkdown() to escape HTML before applying markdown transformations (bold/italic/code)
• Preserves markdown functionality while preventing HTML injection

function escapeHtml(text: string): string {
    return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
}

function parseMarkdown(markdown: string | undefined): string | undefined {
    if (!markdown) return undefined;
    const escaped = escapeHtml(markdown);
    return escaped
        .replace(/\*\*((?:(?!\*\*).)+)\*\*/g, "<strong>$1</strong>")
        .replace(/\*([^*]+)\*/g, "<em>$1</em>")
        .replace(/`([^`]+)`/g, "<code>$1</code>");
}

Original prompt

---

This section details on the original issue you should resolve

<issue_title>JS tooltips interpreting rust generics as HTML elements</issue_title>
<issue_description>A regression introduced by @Keavon in #3488

Tooltips containing strings such as "Table<Vector<Option<Table<Graphic>>>>" are interpreted as HTML tags by the @html label</issue_description>

<agent_instructions>We need to escape HTML tags in Tooltip.svelte</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@Keavon Oh, good find, thanks for noticing this edge case.

• Fixes JS tooltips interpreting rust generics as HTML elements #3520

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Keavon]

You should only have changed the one file.

[Copilot]

You should only have changed the one file.

Fixed in commit 8f9c354. The PR now only includes changes to Tooltip.svelte.

[Keavon]

Use apos instead of 39.

[Copilot]

Changed to ' in commit aa1431b.

[Keavon]

See comment