From 269950cf4af9d0eb60440eabebba4a7ef7d5fc9a Mon Sep 17 00:00:00 2001
From: HRiggs <hriggs0@protonmail.com>
Date: Sat, 24 Jan 2026 02:32:22 -0500
Subject: [PATCH] Fix escaping

---
 steam_workshop_gui.py | 33 +++++++++++++++++++++++++--------
 update_config.py      |  2 +-
 2 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/steam_workshop_gui.py b/steam_workshop_gui.py
index ac31d04..0f1fe2c 100644
--- a/steam_workshop_gui.py
+++ b/steam_workshop_gui.py
@@ -14,6 +14,7 @@ import time
 import webbrowser
 from update_checker import UpdateChecker
 from update_config import get_update_config
+import html
 
 # Load environment variables
 load_dotenv()
@@ -2009,6 +2010,14 @@ class SteamWorkshopGUI:
         except Exception as e:
             self._safe_update_output(f"Error creating Homebrew RML file: {str(e)}\n")
     
+    def escape_xml_text(self, text):
+        """Escape special XML characters in text content"""
+        if not text:
+            return text
+        # Use html.escape to handle XML/HTML entities properly
+        # xml_char_ref=False ensures we get named entities like &amp; instead of numeric ones
+        return html.escape(text, quote=False)
+    
     def generate_homebrew_rml_xml(self, current_mods, workshop_results):
         """Generate the XML content for the homebrew .rml file"""
         xml_lines = [
@@ -2050,12 +2059,14 @@ class SteamWorkshopGUI:
         
         # Add current mod names first
         for package_id, mod_name in current_mods:
-            xml_lines.append(f'\t\t\t<li>{mod_name}</li>')
+            escaped_name = self.escape_xml_text(mod_name)
+            xml_lines.append(f'\t\t\t<li>{escaped_name}</li>')
         
         # Add workshop mod names to meta section
         for workshop_id, package_id in workshop_results:
             mod_name = self.get_mod_name_from_about_xml(workshop_id)
-            xml_lines.append(f'\t\t\t<li>{mod_name}</li>')
+            escaped_name = self.escape_xml_text(mod_name)
+            xml_lines.append(f'\t\t\t<li>{escaped_name}</li>')
         
         xml_lines.extend([
             '\t\t</modNames>',
@@ -2079,12 +2090,14 @@ class SteamWorkshopGUI:
         
         # Add current mod names first to modList section
         for package_id, mod_name in current_mods:
-            xml_lines.append(f'\t\t\t<li>{mod_name}</li>')
+            escaped_name = self.escape_xml_text(mod_name)
+            xml_lines.append(f'\t\t\t<li>{escaped_name}</li>')
         
         # Add workshop mod names to modList section
         for workshop_id, package_id in workshop_results:
             mod_name = self.get_mod_name_from_about_xml(workshop_id)
-            xml_lines.append(f'\t\t\t<li>{mod_name}</li>')
+            escaped_name = self.escape_xml_text(mod_name)
+            xml_lines.append(f'\t\t\t<li>{escaped_name}</li>')
         
         xml_lines.extend([
             '\t\t</names>',
@@ -2179,11 +2192,13 @@ class SteamWorkshopGUI:
         
         # Add core mod names first
         for package_id, mod_name in core_mods:
-            xml_lines.append(f'\t\t\t<li>{mod_name}</li>')
+            escaped_name = self.escape_xml_text(mod_name)
+            xml_lines.append(f'\t\t\t<li>{escaped_name}</li>')
         
         # Add workshop mod names to meta section
         for mod_name in mod_names:
-            xml_lines.append(f'\t\t\t<li>{mod_name}</li>')
+            escaped_name = self.escape_xml_text(mod_name)
+            xml_lines.append(f'\t\t\t<li>{escaped_name}</li>')
         
         xml_lines.extend([
             '\t\t</modNames>',
@@ -2207,11 +2222,13 @@ class SteamWorkshopGUI:
         
         # Add core mod names first to modList section
         for package_id, mod_name in core_mods:
-            xml_lines.append(f'\t\t\t<li>{mod_name}</li>')
+            escaped_name = self.escape_xml_text(mod_name)
+            xml_lines.append(f'\t\t\t<li>{escaped_name}</li>')
         
         # Add workshop mod names to modList section
         for mod_name in mod_names:
-            xml_lines.append(f'\t\t\t<li>{mod_name}</li>')
+            escaped_name = self.escape_xml_text(mod_name)
+            xml_lines.append(f'\t\t\t<li>{escaped_name}</li>')
         
         xml_lines.extend([
             '\t\t</names>',
diff --git a/update_config.py b/update_config.py
index cd1f386..609d1f6 100644
--- a/update_config.py
+++ b/update_config.py
@@ -5,7 +5,7 @@ Configuration settings for the update checker
 # Update checker configuration
 UPDATE_CONFIG = {
     # Current version of the application
-    "current_version": "0.0.3",
+    "current_version": "0.0.4",
     
     # Repository information
     "repo_owner": "HRiggs",