From e83c17fe5761265f1dbe2083365638327408dff8 Mon Sep 17 00:00:00 2001
From: Rin <shinohara-rin@users.noreply.github.com>
Date: Sat, 14 Mar 2026 00:20:15 +0800
Subject: [PATCH] fix(minecraft): xss mitigation for minecraft debug dashboard
 (#1344)

Authored-by-agent: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
---
 services/minecraft/src/debug/web/app.js | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/services/minecraft/src/debug/web/app.js b/services/minecraft/src/debug/web/app.js
index 8d86c804b..b795b06e3 100644
--- a/services/minecraft/src/debug/web/app.js
+++ b/services/minecraft/src/debug/web/app.js
@@ -24,9 +24,14 @@ const SYSTEM_STATE_MARKER = 'The following blackboard provides you with informat
 // =============================================================================
 
 function escapeHtml(text) {
-  const div = document.createElement('div')
-  div.textContent = text
-  return div.innerHTML
+  if (text == null)
+    return ''
+  return String(text)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;')
 }
 
 function formatSystemMessageContent(content) {