From 07c99bda5a47b0e7608528be6ea0d48f6dd5e84e Mon Sep 17 00:00:00 2001
From: Tauan BF <11513929+tauanbinato@users.noreply.github.com>
Date: Fri, 25 Sep 2026 20:02:27 -0300
Subject: [PATCH] Escape rule and schema text in the site's reference pages

The generator writes catalog and schema text into Markdown that mdBook renders as HTML, so markup characters are escaped; today's pages are unchanged.
---
 site/generate.py | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/site/generate.py b/site/generate.py
index e59e570..c3db628 100644
--- a/site/generate.py
+++ b/site/generate.py
@@ -7,6 +7,7 @@
 jevgate.schema.json, and cli.md from each command's --help, so the pages
 always describe the binary they were built with.
 """
+import html
 import json
 import subprocess
 import sys
@@ -52,16 +53,16 @@ def rules_page(binary):
         anchor = rule["id"].replace("/", "-")
         lines += [
             "",
-            f'<a id="{anchor}"></a>',
+            f'<a id="{html.escape(anchor)}"></a>',
             f"### `{rule['id']}`",
             "",
-            f"**Question:** {rule['inspection']}",
+            f"**Question:** {text(rule['inspection'])}",
             "",
             f"- **Key:** `{rule['key']}` · **Version:** {rule['version']}"
             + (" · **Needs tests:** yes" if rule["requires_tests"] else ""),
-            f"- **Looks at:** {rule['scope']}",
-            f"- **Evidence unit:** {rule['unit']}",
-            f"- **Acceptable:** {rule['acceptable_example']}",
+            f"- **Looks at:** {text(rule['scope'])}",
+            f"- **Evidence unit:** {text(rule['unit'])}",
+            f"- **Acceptable:** {text(rule['acceptable_example'])}",
         ]
     policy = rules[0]["decision_policy"]
     lines += [
@@ -137,8 +138,13 @@ def cli_page(binary):
     return "\n".join(lines) + "\n"
 
 
-def cell(text):
-    return text.replace("|", "\\|").replace("\n", " ")
+def text(value):
+    """Catalog and schema text as page text: markup characters are escaped."""
+    return html.escape(value, quote=False)
+
+
+def cell(value):
+    return text(value).replace("|", "\\|").replace("\n", " ")
 
 
 def main():