fix(coverage): escape source code in html coverage report (#21531)

3 files changed, 9 insertions, 2 deletions

diff --git a/cli/tests/integration/coverage_tests.rs b/cli/tests/integration/coverage_tests.rs
index 3317020fb..d3affd4de 100644
--- a/cli/tests/integration/coverage_tests.rs
+++ b/cli/tests/integration/coverage_tests.rs
@@ -553,6 +553,8 @@ fn test_html_reporter() {
   let bar_ts_html =
     fs::read_to_string(tempdir.join("html").join("bar.ts.html")).unwrap();
   assert!(bar_ts_html.contains("<h1>Coverage report for bar.ts</h1>"));
+  // Check <T> in source code is escaped to &lt;T&gt;
+  assert!(bar_ts_html.contains("&lt;T&gt;"));
 
   let baz_index_html =
     fs::read_to_string(tempdir.join("html").join("baz").join("index.html"))
diff --git a/cli/tests/testdata/coverage/multisource/bar.ts b/cli/tests/testdata/coverage/multisource/bar.ts
index 1bb10a0a6..123937b0b 100644
--- a/cli/tests/testdata/coverage/multisource/bar.ts
+++ b/cli/tests/testdata/coverage/multisource/bar.ts
@@ -1,4 +1,4 @@
-export function bar(cond: boolean) {
+export function bar<T>(cond: T) {
   if (cond) {
     return 1;
   } else {
diff --git a/cli/tools/coverage/reporter.rs b/cli/tools/coverage/reporter.rs
index da8982b8d..e94b54255 100644
--- a/cli/tools/coverage/reporter.rs
+++ b/cli/tools/coverage/reporter.rs
@@ -512,7 +512,7 @@ impl HtmlCoverageReporter {
   /// Creates <table> of single file code coverage.
   pub fn create_html_code_table(
     &self,
-    file_text: &String,
+    file_text: &str,
     report: &CoverageReport,
   ) -> String {
     let line_num = file_text.lines().count();
@@ -548,6 +548,11 @@ impl HtmlCoverageReporter {
       .collect::<Vec<_>>()
       .join("\n");
 
+    let file_text = file_text
+      .replace('&', "&amp;")
+      .replace('<', "&lt;")
+      .replace('>', "&gt;");
+
     // TODO(kt3k): Add syntax highlight to source code
     format!(
       "<table class='coverage'>