fix(gis): escape marker labels before rendering

src/components/GisMapCanvas.vue

@@ -26,6 +26,15 @@ let overlays = []
 
 const convertedCenter = computed(() => convertCoord(props.center.lng, props.center.lat))
 
+function escapeHtml(value) {
+  return String(value ?? '')
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;')
+}
+
 function waitForBMapGL() {
   return new Promise((resolve, reject) => {
     if (window.BMapGL) {

tests/gisMapCanvas.test.mjs

@@ -16,6 +16,7 @@ test('shared gis map canvas converts WGS84 coordinates before BMapGL rendering',
 test('shared gis map canvas renders every point as an official icon with a label above it', async () => {
   const source = await readFile('src/components/GisMapCanvas.vue', 'utf8')
 
+  assert.match(source, /function escapeHtml\(value\)/u)
   assert.match(source, /markerSize: \{ type: Number, default: 28 \}/u)
   assert.match(source, /const iconUrl = point\.iconUrl \|\| getMonitoringPointIcon\(point\)/u)
   assert.match(source, /new BMapGL\.Icon\(iconUrl, new BMapGL\.Size\(size, size\), \{/u)