'sanitize_label' double-encodes HTML entities in 'to_html' JSON output

[flexmox]

Bug

sanitize_label() in security.py calls html.escape() on all node labels and community names. These sanitized strings are then passed through json.dumps() and embedded inside a <script> tag in to_html().

This causes double-encoding: & becomes & in the JSON string values, which vis.js then renders literally as & in the browser instead of &.

Reproduction

Any node label containing & (e.g. "Abercrombie & Fitch", "CX & Behavioral Data") will display as Abercrombie & Fitch in the interactive graph.

Root cause

security.py:198 — html.escape() is appropriate for text injected into raw HTML, but the labels in to_html() are embedded inside json.dumps() within a <script> block (export.py:370-372). JavaScript string literals don't need HTML-escaping — json.dumps already handles the necessary escaping for that context.

Note:

I found this issue myself but I had Claude Opus 4.6 write it up

[safishamsi]

Fixed in v0.3.12. sanitize_label no longer calls html.escape() — it strips control chars and caps length only. The one place that injects a label directly into HTML (to_html title) now calls html.escape() explicitly. No more double-encoding.