Function html_escape

crates/openshell-server/src/auth/http.rs:387–400

Minimal HTML attribute escaping for untrusted values. Escapes `&`, `"`, `'`, `<`, and `>` so the value is safe for embedding inside a quoted HTML attribute.

(s: &str)

/// Escapes `&`, `"`, `'`, `<`, and `>` so the value is safe for embedding
/// inside a quoted HTML attribute.
fn html_escape(s: &str) -> String {
    let mut out = String::with_capacity(s.len());
    for ch in s.chars() {
        match ch {
            '&' => out.push_str("&amp;"),
            '"' => out.push_str("&quot;"),
            '\'' => out.push_str("&#x27;"),
            '<' => out.push_str("&lt;"),
            '>' => out.push_str("&gt;"),
            c => out.push(c),
        }
    }
    out
}

/// Render a waiting page shown when the edge proxy auth cookie is not yet present.
///