🔒 fix(security): use stdlib html.escape() for complete XSS protection

docksec/docker_scanner.py

@@ -1302,24 +1302,19 @@ def _escape_html(self, text: str) -> str:
         """
         Escape HTML special characters in text.
 
+        Uses Python's built-in html.escape() for complete HTML5
+        entity handling, replacing the previous hand-rolled table.
+
         Args:
             text: Text to escape
 
         Returns:
             HTML-escaped text
         """
+        import html
         if not text:
             return ""
-
-        html_escape_table = {
-            "&": "&",
-            '"': """,
-            "'": "'",
-            ">": ">",
-            "<": "&lt;",
-        }
-
-        return "".join(html_escape_table.get(c, c) for c in str(text))
+        return html.escape(str(text), quote=True)
 
 def main():
     """Main function to run the security scanner."""

docksec/report_generator.py

@@ -458,24 +458,19 @@ def _escape_html(self, text: str) -> str:
         """
         Escape HTML special characters in text.
 
+        Uses Python's built-in html.escape() for complete HTML5
+        entity handling, replacing the previous hand-rolled table.
+
         Args:
             text: Text to escape
 
         Returns:
             HTML-escaped text
         """
+        import html
         if not text:
             return ""
-
-        html_escape_table = {
-            "&": "&",
-            '"': """,
-            "'": "'",
-            ">": ">",
-            "<": "&lt;",
-        }
-
-        return "".join(html_escape_table.get(c, c) for c in str(text))
+        return html.escape(str(text), quote=True)
 
     def _count_by_severity(self, vulnerabilities: List[Dict]) -> Dict[str, int]:
         """