fix: escape html to get tooltip text (#167)

src/cellmanager.js

@@ -2,7 +2,8 @@ import {
     copyTextToClipboard,
     makeDataAttributeString,
     throttle,
-    linkProperties
+    linkProperties,
+    escapeHTML,
 } from './utils';
 import $ from './dom';
 import icons from './icons';
@@ -886,7 +887,7 @@ export default class CellManager {
         let textContent = div.textContent;
         textContent = textContent.replace(/\s+/g, ' ').trim();
 
-        cellContentHTML = cellContentHTML.replace('>', ` title="${textContent}">`);
+        cellContentHTML = cellContentHTML.replace('>', ` title="${escapeHTML(textContent)}">`);
 
         return cellContentHTML;
     }

src/utils.js

@@ -149,3 +149,19 @@ export function format(str, args) {
 
     return str;
 };
+
+export function escapeHTML(txt) {
+    if (!txt) return '';
+    let escapeHtmlMapping = {
+        '&': '&',
+        '<': '&lt;',
+        '>': '&gt;',
+        '"': '&quot;',
+        "'": '&#39;',
+        '/': '&#x2F;',
+        '`': '&#x60;',
+        '=': '&#x3D;',
+    };
+
+    return String(txt).replace(/[&<>"'`=/]/g, (char) => escapeHtmlMapping[char] || char);
+};