From ceffce3ba9f8f892e3086a96ad804fd9e1a5d448 Mon Sep 17 00:00:00 2001
From: Mateus Boergeson <mateusboergeson@gmail.com>
Date: Sat, 29 Aug 2026 14:21:00 +0200
Subject: [PATCH 1/2] fix(result-word-highlight): escape input after slicing

---
 frontend/src/ts/elements/result-word-highlight.ts | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/frontend/src/ts/elements/result-word-highlight.ts b/frontend/src/ts/elements/result-word-highlight.ts
index cfb997b5bb89..354a47a1e42b 100644
--- a/frontend/src/ts/elements/result-word-highlight.ts
+++ b/frontend/src/ts/elements/result-word-highlight.ts
@@ -311,12 +311,12 @@ async function init(): Promise<boolean> {
 
       // Calculate inputWordEl properties relative to inputWordsContainerEl
       inputWordEl.style.left = `${wordEl.offsetLeft + PADDING_OFFSET_X - RTL_offset}px`;
-      inputWordEl.innerHTML = userInputString
-        .replace(/\t/g, "_")
-        .replace(/\n/g, "_")
-        .replace(/</g, "&lt")
-        .replace(/>/g, "&gt")
-        .slice(0, wordEl.childElementCount);
+      inputWordEl.innerHTML = Misc.escapeHTML(
+        userInputString
+          .replace(/\t/g, "_")
+          .replace(/\n/g, "_")
+          .slice(0, wordEl.childElementCount),
+      );
 
       inputWordEl.className = "inputWord";
       inputWordsContainerEl.append(inputWordEl);

From 94ee04905190c0ea8bc6ac29d3d5c0c9d77a830b Mon Sep 17 00:00:00 2001
From: Mateus Boergeson <mateusboergeson@gmail.com>
Date: Sat, 29 Aug 2026 14:21:01 +0200
Subject: [PATCH 2/2] refactor(test-ui): use escapeHTML for word input

---
 frontend/src/ts/test/test-ui.ts | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/frontend/src/ts/test/test-ui.ts b/frontend/src/ts/test/test-ui.ts
index d55ceba54553..be9a6f1e694c 100644
--- a/frontend/src/ts/test/test-ui.ts
+++ b/frontend/src/ts/test/test-ui.ts
@@ -1402,11 +1402,7 @@ async function loadWordsHistory(): Promise<boolean> {
         "beforeend",
         `<div class="wordInputHighlight withSpeed">
           <div class="text">
-          ${input
-            .replace(/\t/g, "_")
-            .replace(/\n/g, "_")
-            .replace(/</g, "&lt")
-            .replace(/>/g, "&gt")}
+          ${Misc.escapeHTML(input.replace(/\t/g, "_").replace(/\n/g, "_"))}
           </div>
           <div class="speed">
           ${isNaN(burst) || burst >= 1000 ? "Infinite" : Format.typingSpeed(burst, { showDecimalPlaces: false })}