builder.addEscape(c, "\uFFFD");
      }
    }

    // Build the content escaper first and then add quote escaping for the
    // general escaper.
    builder.addEscape('&', "&");
    builder.addEscape('<', "&lt;");
    builder.addEscape('>', "&gt;");
    XML_CONTENT_ESCAPER = builder.build();
    builder.addEscape('\'', "&apos;");
    builder.addEscape('"', "&quot;");

        // Replace YouTube references by embedded videos, ?si= attribute is a must
        // E.g. @youtube(Summary,UN0AFCLASZA?si=9aG5tDzj6nL1_IKT&start=371)@ => https://www.youtube.com/embed/UN0AFCLASZA?si=9aG5tDzj6nL1_IKT&start=371"
        // "&rel=0" is also force-injected to prevent video recommendations from other channels
        rewritten = rewritten.replaceAll("\\@youtube\\(([a-zA-Z\\-_]+)\\,([^\\s<]+)\\)\\@",
            "<details> \n" +

    public void test_escapeHtml_noSpecialChars() {
        assertEquals("hello world", chatClient.testEscapeHtml("hello world"));
    }

    @Test
    public void test_escapeHtml_ampersand() {
        assertEquals("a & b", chatClient.testEscapeHtml("a & b"));
    }

    @Test
    public void test_escapeHtml_lessThan() {
        assertEquals("a &lt; b", chatClient.testEscapeHtml("a < b"));
    }

    @Test

One is in constant evaluation.
Constant expressions in the assembler are parsed using Go's operator
precedence, not the C-like precedence of the original.
Thus <code>3&amp;1&lt;&lt;2</code> is 4, not 0—it parses as <code>(3&amp;1)&lt;&lt;2</code>
not <code>3&amp;(1&lt;&lt;2)</code>.
Also, constants are always evaluated as 64-bit unsigned integers.
Thus <code>-2</code> is not the integer value minus two,

    /** The key of the message: Menu */
    public static final String LABELS_SIDEBAR_MENU = "{labels.sidebar.menu}";

    /** The key of the message: ©2026 <a href="https://github.com/codelibs">CodeLibs Project</a>. */
    public static final String LABELS_FOOTER_COPYRIGHT = "{labels.footer.copyright}";

    /** The key of the message: Search */

        assertTrue(html.contains("<title>Title with &lt;script&gt;alert(&#39;xss&#39;)&lt;/script&gt;</title>"));
        assertTrue(html.contains("Content with &amp; &lt; &gt; &quot; &#39;"));
        assertFalse(html.contains("<script>"));
    }

    @Test
    public void test_buildHtml_excludeFields() {
        final Map<String, Object> source = new LinkedHashMap<>();

     */
    boolean canRead() throws CIFSException;

    /**
     * Turn off the read-only attribute of this file. This is shorthand for
     * <code>setAttributes( getAttributes() &amp; ~ATTR_READONLY )</code>.
     *
     * @throws CIFSException if an error occurs modifying the resource
     */
    void setReadWrite() throws CIFSException;

    /**

ce("protocol",re).getRegex()},pt={...N,br:k(ae).replace("{2,}","*").getRegex(),text:k(N.text).replace("\\b_","\\b_| {2,}\\n").replace(/\{2,\}/g,"*").getRegex()},B={normal:K,gfm:qe,pedantic:ve},z={normal:X,gfm:N,breaks:pt,pedantic:ut};var ct={"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"},ge=l=>ct[l];function O(l,e){if(e){if(m.escapeTest.test(l))return l.replace(m.escapeReplace,ge)}else if(m.escapeTestNoEncode.test(l))return l.replace(m.escapeReplaceNoEncode,ge);return l}function J(l...

     * @return the escaped text
     */
    protected String escapeHtml(final String text) {
        if (text == null) {
            return "";
        }
        return text.replace("&", "&amp;").replace("<", "&lt;").replace(">", "&gt;").replace("\"", "&quot;").replace("'", "&#39;");
    }

    /**
     * Gets the maximum number of history messages to retain.
     *

 * Manually using `StringBuilder` to assemble these components is cumbersome: do '+' characters get
 * silently replaced with spaces? If a query parameter contains a '&', does that get escaped?
 * By offering methods to read and write individual query parameters directly, application
 * developers are saved from the hassles of encoding and decoding.
 *
 * ### Plus a modern API
 *