security: HTML-escape user-controlled vertex names in HTML reports (CWE-79)

GraphHealthChecker.toHtml() injected vertex names (isolatedNodes,
degreeOutliers) from graph files directly into HTML via truncateList()
without escaping. A malicious graph file with vertex names containing
HTML/JS (e.g. '<img/src=x onerror=alert(1)>') would execute arbitrary
scripts when the health report was opened in a browser.

Fix: wrap truncateList() output with ExportUtils.escapeHtml() for both
isolated-node and degree-outlier findings.

GraphDiffHtmlExporter used D3's .html() (which parses HTML) with raw
vertex IDs in tooltip template literals. Added a client-side esc()
helper that uses textContent/innerHTML to sanitize vertex names before
HTML insertion.

Author: sauravbhattacharya001

Gvisual/src/gvisual/GraphDiffHtmlExporter.java

@@ -236,6 +236,7 @@ private void appendData(StringBuilder sb, GraphDiffAnalyzer.DiffResult diff) {
     private void appendJs(StringBuilder sb) {
         sb.append(
             "const colors = { added: '#00e676', removed: '#ff5252', common: '#78909c' };\n" +
+            "function esc(s){var d=document.createElement('span');d.textContent=s;return d.innerHTML;}\n" +
             "const tooltip = d3.select('#tooltip');\n" +
             "const container = d3.select('#graph');\n" +
             "const w = container.node().clientWidth;\n" +
@@ -294,7 +295,7 @@ private void appendJs(StringBuilder sb) {
             "    .call(d3.drag().on('start', dragStart).on('drag', dragging).on('end', dragEnd))\n" +
             "    .on('mouseover', (e, d) => {\n" +
             "      tooltip.style('display', 'block')\n" +
-            "        .html(`<b>${d.id}</b><br>Status: ${d.status}<br>Degree in ${diffData.labelA}: ${d.degA}<br>Degree in ${diffData.labelB}: ${d.degB}`)\n" +
+            "        .html(`<b>${esc(d.id)}</b><br>Status: ${d.status}<br>Degree in ${esc(diffData.labelA)}: ${d.degA}<br>Degree in ${esc(diffData.labelB)}: ${d.degB}`)\n" +
             "        .style('left', (e.pageX + 12) + 'px').style('top', (e.pageY - 10) + 'px');\n" +
             "    })\n" +
             "    .on('mouseout', () => tooltip.style('display', 'none'))\n" +

Gvisual/src/gvisual/GraphHealthChecker.java

@@ -183,7 +183,7 @@ public static String toHtml(HealthReport r) {
             sb.append("<div class='issue ok'>✅ No isolated nodes</div>");
         } else {
             sb.append(String.format("<div class='issue'>⚠️ %d isolated node(s): %s</div>",
-                    r.isolatedNodes.size(), truncateList(r.isolatedNodes, 20)));
+                    r.isolatedNodes.size(), ExportUtils.escapeHtml(truncateList(r.isolatedNodes, 20))));
         }
         if (r.selfLoops.isEmpty()) {
             sb.append("<div class='issue ok'>✅ No self-loops</div>");
@@ -211,7 +211,7 @@ public static String toHtml(HealthReport r) {
             sb.append("<div class='issue ok'>✅ No degree outliers</div>");
         } else {
             sb.append(String.format("<div class='issue'>⚠️ %d degree outlier(s): %s</div>",
-                    r.degreeOutliers.size(), truncateList(r.degreeOutliers, 15)));
+                    r.degreeOutliers.size(), ExportUtils.escapeHtml(truncateList(r.degreeOutliers, 15))));
         }
 
         sb.append("</body></html>");