From 187541dc192d133f7ef909c5bf483cd9bbb78413 Mon Sep 17 00:00:00 2001
From: Antonella Sgarlatta <anto@standardnotes.com>
Date: Wed, 5 Aug 2026 11:38:04 -0300
Subject: [PATCH] fix: Escapes preview HTML in checklist editor

---
 .../app/lib/tasksManager.js                           | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/packages/org.standardnotes.simple-task-editor/app/lib/tasksManager.js b/packages/org.standardnotes.simple-task-editor/app/lib/tasksManager.js
index 6b3c043f..c5fe47bc 100644
--- a/packages/org.standardnotes.simple-task-editor/app/lib/tasksManager.js
+++ b/packages/org.standardnotes.simple-task-editor/app/lib/tasksManager.js
@@ -3,6 +3,15 @@ import ComponentRelay from '@standardnotes/component-relay'
 
 const TaskDelimitter = '\n'
 
+function escapeHtml(text) {
+  return String(text)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;')
+}
+
 export default class TasksManager {
   spellcheckEnabled = true
 
@@ -189,7 +198,7 @@ export default class TasksManager {
       html += "<ul style='padding-left: 19px; margin-top: 10px;'>"
       for (let i = 0; i < tasksToPreview; i++) {
         const task = openTasks[i]
-        html += `<li style='margin-bottom: 6px;'>${task.content}</li>`
+        html += `<li style='margin-bottom: 6px;'>${escapeHtml(task.content)}</li>`
       }
       html += '</ul>'