Fix HTML escaping for generic type parameters in reports

src/DotNetApiDiff/Reporting/HtmlFormatterScriban.cs

@@ -64,6 +64,21 @@ public string Format(ComparisonResult result)
         return _mainTemplate.Render(context);
     }
 
+    private static string HtmlEscape(string? input)
+    {
+        if (string.IsNullOrEmpty(input))
+        {
+            return input ?? string.Empty;
+        }
+
+        return input
+            .Replace("&", "&")
+            .Replace("<", "&lt;")
+            .Replace(">", "&gt;")
+            .Replace("\"", "&quot;")
+            .Replace("'", "&#39;");
+    }
+
     private object PrepareConfigData(ComparisonConfiguration config)
     {
         var namespaceMappings = config?.Mappings?.NamespaceMappings ?? new Dictionary<string, List<string>>();
@@ -231,8 +246,8 @@ private object[] GroupChanges(List<ApiDifference> changes)
                     description = c.Description,
                     is_breaking_change = c.IsBreakingChange,
                     has_signatures = !string.IsNullOrEmpty(c.OldSignature) || !string.IsNullOrEmpty(c.NewSignature),
-                    old_signature = c.OldSignature,
-                    new_signature = c.NewSignature,
+                    old_signature = HtmlEscape(c.OldSignature),
+                    new_signature = HtmlEscape(c.NewSignature),
                     details_id = $"details-{Guid.NewGuid():N}"
                 }).ToArray()
             }).ToArray();

tests/DotNetApiDiff.Tests/Reporting/HtmlFormatterScribanTests.cs

@@ -181,6 +181,43 @@ public void Format_WithSignatures_IncludesSignatureDetails()
         Assert.Contains("public void ChangedMethod(string param)", report);
     }
 
+    [Fact]
+    public void Format_WithGenericTypeSignatures_ProperlyEscapesHtml()
+    {
+        // Arrange
+        var result = new ComparisonResult
+        {
+            OldAssemblyPath = "source.dll",
+            NewAssemblyPath = "target.dll",
+            ComparisonTimestamp = new DateTime(2023, 1, 1, 12, 0, 0, DateTimeKind.Utc),
+            Configuration = CreateDefaultConfiguration(),
+            Differences = new List<ApiDifference>
+            {
+                new ApiDifference
+                {
+                    ChangeType = ChangeType.Added,
+                    ElementType = ApiElementType.Method,
+                    ElementName = "Execute",
+                    Description = "Added method with generic parameters",
+                    NewSignature = "public ValkeyResult Execute(string command, ICollection<object> args)",
+                    Severity = SeverityLevel.Info
+                }
+            }
+        };
+
+        // Act
+        var report = _formatter.Format(result);
+
+        // Assert
+        Assert.NotNull(report);
+        Assert.Contains("Added Items", report);
+        Assert.Contains("Execute", report);
+        // Verify that generic type parameters are properly HTML-escaped
+        Assert.Contains("ICollection&lt;object&gt;", report);
+        // Verify that unescaped angle brackets are not present
+        Assert.DoesNotContain("ICollection<object>", report);
+    }
+
     private static ComparisonConfiguration CreateDefaultConfiguration()
     {
         return new ComparisonConfiguration