From 95559cda5950ab7cb9177939fe79094a30f49da2 Mon Sep 17 00:00:00 2001
From: C85297 <95289555+C85297@users.noreply.github.com>
Date: Wed, 17 Jun 2026 20:40:48 +0100
Subject: [PATCH] Fix operation description rendering

---
 src/web/HTMLOperation.mjs      |  3 ++-
 tests/browser/00_nightwatch.js | 17 +++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/src/web/HTMLOperation.mjs b/src/web/HTMLOperation.mjs
index 725f0b5f..0ba0ffc8 100755
--- a/src/web/HTMLOperation.mjs
+++ b/src/web/HTMLOperation.mjs
@@ -56,9 +56,10 @@ class HTMLOperation {
 
         if (this.description) {
             const infoLink = this.infoURL ? `<hr>${titleFromWikiLink(this.infoURL)}` : "";
+            const content = Utils.escapeHtml(this.description + infoLink);
 
             html += ` data-container='body' data-toggle='popover' data-placement='right'
-                data-content="${this.description}${infoLink}" data-html='true' data-trigger='hover'
+                data-content="${content}" data-html='true' data-trigger='hover'
                 data-boundary='viewport' role='button'`;
         }
 
diff --git a/tests/browser/00_nightwatch.js b/tests/browser/00_nightwatch.js
index e64b476b..ac3fb08c 100644
--- a/tests/browser/00_nightwatch.js
+++ b/tests/browser/00_nightwatch.js
@@ -56,6 +56,23 @@ module.exports = {
         browser.expect.element("//li[contains(@class, 'operation') and text()='Play Media']").to.be.present;
         browser.expect.element("//li[contains(@class, 'operation') and text()='Disassemble x86']").to.be.present;
         browser.expect.element("//li[contains(@class, 'operation') and text()='Register']").to.be.present;
+        browser.expect.element("//li[contains(@class, 'operation') and text()='Escape Smart Characters']").to.be.present;
+    },
+
+    "Operation popover descriptions render HTML safely": browser => {
+        const op = "//li[contains(@class, 'operation') and text()='Escape Smart Characters']";
+
+        browser
+            .useXpath()
+            .moveToElement(op, 10, 10)
+            .useCss()
+            .waitForElementVisible(".popover-body code:last-of-type", 1000)
+            .expect.element(".popover-body code:last-of-type").text.to.contain("\"Hello\" -- world...");
+
+        browser
+            .useCss()
+            .moveToElement("#operations .title", 1, 1)
+            .waitForElementNotPresent(".popover-body", 1000);
     },
 
     "Recipe can be run": browser => {