security: fix XSS in NetworkFlowExporter — escape node labels in JS output (CWE-79)

NetworkFlowExporter.export() injected node labels directly into
JavaScript string literals without escaping. A node label containing
single quotes or script-breaking characters (e.g. '); alert(1);//)
would break out of the JS string and execute arbitrary code when the
exported HTML file is opened in a browser.

Replace unescaped string interpolation with ExportUtils.jsonString()
which properly escapes backslashes, quotes, newlines, and control
characters, and uses double-quoted JSON strings instead of single-quoted
JS literals.

Author: sauravbhattacharya001

Gvisual/src/gvisual/NetworkFlowExporter.java

@@ -116,7 +116,7 @@ public void export(String filePath) throws IOException {
         for (int i = 0; i < nodes.size(); i++) {
             FlowNode nd = nodes.get(i);
             if (i > 0) nodesJson.append(",");
-            nodesJson.append(String.format("{id:%d,x:%.0f,y:%.0f,label:'%s'}", i, nd.x, nd.y, nd.label));
+            nodesJson.append(String.format("{id:%d,x:%.0f,y:%.0f,label:%s}", i, nd.x, nd.y, ExportUtils.jsonString(nd.label)));
         }
         nodesJson.append("]");