From 9eb6ec4db8b0f91938498a71ccf2935efc299b33 Mon Sep 17 00:00:00 2001
From: Eltaurus <Eltaurus@mail.ru>
Date: Mon, 27 Oct 2025 18:41:40 +0600
Subject: [PATCH] Fix unescaped HTML in correct type-in answers (#4407)

* Fix unescaped HTML in correct type-in answers

* unit test for correct answer escaping

* fix string conversion
---
 CONTRIBUTORS            |  1 +
 rslib/src/typeanswer.rs | 11 ++++++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/CONTRIBUTORS b/CONTRIBUTORS
index 43f7a7e46..01573b419 100644
--- a/CONTRIBUTORS
+++ b/CONTRIBUTORS
@@ -252,6 +252,7 @@ Amanda Sternberg <mandis.sternberg@gmail.com>
 arold0 <arold0@icloud.com> 
 nav1s <nav1s@proton.me>
 Ranjit Odedra <ranjitodedra.dev@gmail.com>
+Eltaurus <https://github.com/Eltaurus-Lt>
 
 ********************
 
diff --git a/rslib/src/typeanswer.rs b/rslib/src/typeanswer.rs
index 08c638e12..9bf3dc47c 100644
--- a/rslib/src/typeanswer.rs
+++ b/rslib/src/typeanswer.rs
@@ -58,7 +58,7 @@ trait DiffTrait {
         if self.get_typed() == self.get_expected() {
             format_typeans!(format!(
                 "<span class=typeGood>{}</span>",
-                self.get_expected_original()
+                htmlescape::encode_minimal(&self.get_expected_original())
             ))
         } else {
             let output = self.to_tokens();
@@ -391,6 +391,15 @@ mod test {
         assert_eq!(ctx, "<code id=typeans>123</code>");
     }
 
+    #[test]
+    fn correct_input_is_escaped() {
+        let ctx = Diff::new("source <dir>/bin/activate", "source <dir>/bin/activate");
+        assert_eq!(
+            ctx.to_html(),
+            "<code id=typeans><span class=typeGood>source &lt;dir&gt;/bin/activate</span></code>"
+        );
+    }
+
     #[test]
     fn correct_input_is_collapsed() {
         let ctx = Diff::new("123", "123");