fix: HTML-escape plot titles and axis labels (close #82)

Author: paulmueller

CHANGELOG

@@ -1,3 +1,5 @@
+2.6.4
+ - fix: HTML-escape plot titles and axis labels (#82)
 2.6.3
  - build: pin rpy2 to 3.4.2 on Windows (#84)
 2.6.2

shapeout2/gui/pipeline_plot.py

@@ -1,4 +1,5 @@
 import copy
+import html
 import pkg_resources
 import warnings
 
@@ -114,7 +115,9 @@ def update_content(self):
 
         # font size for plot title (default size + 2)
         size = "{}pt".format(QtGui.QFont().pointSize() + 2)
-        self.plot_layout.addLabel(lay["name"], colspan=3, size=size)
+        self.plot_layout.addLabel(html.escape(lay["name"]),
+                                  colspan=3,
+                                  size=size)
         self.plot_layout.nextRow()
 
         self.plot_layout.addLabel(labely, angle=-90)
@@ -328,7 +331,7 @@ def redraw(self, dslist, slot_states, plot_state):
                 # only one scatter plot
                 ss = slot_states[0]
                 self.setTitle("")  # fake title
-                add_label(text=ss["name"],
+                add_label(text=html.escape(ss["name"]),
                           anchor_parent=self.titleLabel.item,
                           color=ss["color"],
                           text_halign="center",
@@ -586,23 +589,31 @@ def add_scatter(plot_item, plot_state, rtdc_ds, slot_state):
 
 def get_axes_labels(plot_state, slot_states):
     gen = plot_state["general"]
-    labelx = dclab.dfn.get_feature_label(gen["axis x"])
-    labely = dclab.dfn.get_feature_label(gen["axis y"])
-    # replace FL-? with user-defined names
-    fl_names = slot_states[0]["fl names"]
-    if labelx.count("FL"):
-        for key in fl_names:
-            if key in labelx:
-                labelx = labelx.replace(key, fl_names[key])
-                break
-    if labely.count("FL"):
-        for key in fl_names:
-            if key in labely:
-                labely = labely.replace(key, fl_names[key])
-                break
+    # Use slot_states[0] because we only have one x-axis label
+    labelx = get_axis_label_from_feature(gen["axis x"], slot_states[0])
+    labely = get_axis_label_from_feature(gen["axis y"], slot_states[0])
     return labelx, labely
 
 
+def get_axis_label_from_feature(feat, slot_state=None):
+    """Return the axis label for plotting given a feature name
+
+    - replace the fluorescence names with user-defined strings
+      from `slot_state["fl names"]` if `slot_state` is given
+    - html-escape all characters
+    """
+    label = dclab.dfn.get_feature_label(feat)
+    # replace FL-? with user-defined names
+    if slot_state is not None and "fl names" in slot_state:
+        fl_names = slot_state["fl names"]
+        if label.count("FL") and feat.startswith("fl"):
+            for key in fl_names:
+                if key in label:
+                    label = label.replace(key, fl_names[key])
+                    break
+    return html.escape(label)
+
+
 def set_viewbox(plot, range_x, range_y, scale_x="linear", scale_y="linear",
                 padding=0):
     # Set Log scale

shapeout2/gui/quick_view/qv_scatter.py

@@ -1,4 +1,3 @@
-import dclab
 import numpy as np
 from PyQt5 import QtCore
 import pyqtgraph as pg
@@ -116,16 +115,10 @@ def plot_data(self, rtdc_ds, slot, xax="area_um", yax="deform",
         # set data
         self.setData(x, y, brush=brush)
         # set axes labels (replace with user-defined flourescence names)
-        left = dclab.dfn.get_feature_label(self.yax)
-        bottom = dclab.dfn.get_feature_label(self.xax)
-        for key in self.slot.fl_name_dict:
-            if key in left:
-                left = left.replace(key, self.slot.fl_name_dict[key])
-                break
-        for key in self.slot.fl_name_dict:
-            if key in bottom:
-                bottom = bottom.replace(key, self.slot.fl_name_dict[key])
-                break
+        left = pipeline_plot.get_axis_label_from_feature(
+            self.yax, slot_state=self.slot.__getstate__())
+        bottom = pipeline_plot.get_axis_label_from_feature(
+            self.xax, slot_state=self.slot.__getstate__())
         self.plotItem.setLabels(left=left, bottom=bottom)
 
         # Force updating the plot item size, otherwise axes labels