From 8bc950ba874c821926dfe2ba8f4bf4dbfcae9adb Mon Sep 17 00:00:00 2001
From: Jackson Harper <jacksonh@gmail.com>
Date: Mon, 29 Aug 2022 22:26:06 +0800
Subject: [PATCH] Use underscore to escape XML

---
 packages/text-to-speech/package.json      | 4 +++-
 packages/text-to-speech/src/htmlToSsml.ts | 3 ++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/packages/text-to-speech/package.json b/packages/text-to-speech/package.json
index fa9db0f24..380c638e4 100644
--- a/packages/text-to-speech/package.json
+++ b/packages/text-to-speech/package.json
@@ -21,6 +21,7 @@
   },
   "devDependencies": {
     "@types/node": "^14.11.2",
+    "@types/underscore": "^1.11.4",
     "eslint-plugin-prettier": "^4.0.0"
   },
   "dependencies": {
@@ -31,6 +32,7 @@
     "dotenv": "^16.0.1",
     "jsonwebtoken": "^8.5.1",
     "linkedom": "^0.14.12",
-    "microsoft-cognitiveservices-speech-sdk": "^1.22.0"
+    "microsoft-cognitiveservices-speech-sdk": "^1.22.0",
+    "underscore": "^1.13.4"
   }
 }
diff --git a/packages/text-to-speech/src/htmlToSsml.ts b/packages/text-to-speech/src/htmlToSsml.ts
index 6973d9613..79d02b053 100644
--- a/packages/text-to-speech/src/htmlToSsml.ts
+++ b/packages/text-to-speech/src/htmlToSsml.ts
@@ -1,4 +1,5 @@
 import { parseHTML } from 'linkedom'
+import * as _ from 'underscore'
 
 // this code needs to be kept in sync with the
 // frontend code in: useReadingProgressAnchor
@@ -59,7 +60,7 @@ function emit(textItems: string[], text: string) {
 }
 
 function cleanTextNode(textNode: ChildNode): string {
-  return (textNode.textContent ?? '').replace(/\s+/g, ' ')
+  return _.escape(textNode.textContent ?? ''.replace(/\s+/g, ' '))
 }
 
 function emitTextNode(