ergosteur
dba3ee1815
The previous fix escaped AD data at generation time in both scripts, but the converter still blindly trusted its input -- a report from before that fix, from a hand edit, or from a third-party tool would still render live HTML unmodified. Normalize the whole Markdown source before parsing: unescape any existing entities, then re-escape &, <, > uniformly. The round trip keeps already-escaped (freshly generated) reports single-escaped instead of doubling up, while raw/legacy unescaped HTML gets neutralized for the first time. Neither script intentionally emits raw HTML, so this is safe across all normal report content. Verified: a freshly-escaped report stays single-escaped (AT&T reads as AT&T, not AT&amp;T), a hand-written report with a live <script> tag gets neutralized, and a full report with badges/TOC/ timestamps/tables still renders identically to before.