Escape website title in webview HTML

- HTML-escape title before inserting it into <title>.

├── apps
│   └── editor
│       ├── package.json
│       └── src
│           └── views
│               └── prompt
│                   ├── backend
│                   │   ├── message-handlers
│                   │   │   ├── handle-open-website.ts
│                   │   │   ├── handle-paste-url.ts
│                   │   │   └── index.ts
│                   │   ├── prompt-view-provider.ts
│                   │   └── utils
│                   │       ├── persistent-text-storage.ts
│                   │       ├── symbols
│                   │       │   ├── replace-symbols.ts
│                   │       │   └── website
│                   │       │       └── replace-website-symbol.ts
│                   │       └── website-fetcher.ts
│                   ├── frontend
│                   │   ├── Main
│                   │   │   ├── Main.tsx
│                   │   │   └── MainView
│                   │   │       └── MainView.tsx
│                   │   └── Prompt.tsx
│                   └── types
│                       └── messages.ts
└── packages
    └── ui
        └── src
            └── components
                └── editor
                    └── common
                        └── prompts
                            └── PromptField
                                ├── PromptField.tsx
                                └── hooks
                                    └── use-handlers
                                        └── handle-input-click.ts

Author: robertpiosik

apps/editor/src/views/prompt/backend/message-handlers/handle-open-website.ts

@@ -92,6 +92,13 @@ export const handle_open_website = async (
 
     const csp = webview_panel.webview.cspSource
 
+    const escaped_title = title
+      .replace(/&/g, '&')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&#039;')
+
     webview_panel.webview.html = `
       <!DOCTYPE html>
       <html lang="en">
@@ -102,7 +109,7 @@ export const handle_open_website = async (
         <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.11.1/styles/vs2015.min.css">
         <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.11.1/highlight.min.js"></script>
         <script>document.addEventListener('DOMContentLoaded', () => hljs.highlightAll());</script>
-        <title>${title}</title>
+        <title>${escaped_title}</title>
         <style>
           body {
             line-height: 1.5;