gh-153840: Escape special characters in flamegraph function names

Author: tonghuaroot

Lib/profiling/sampling/_flamegraph_assets/flamegraph.js

@@ -322,7 +322,7 @@ function createPythonTooltip(data) {
     const childCount = d.children ? d.children.length : 0;
     const source = d.data.source;
 
-    const funcname = resolveString(d.data.funcname) || resolveString(d.data.name);
+    const funcname = escapeHtml(resolveString(d.data.funcname) || resolveString(d.data.name) || "");
     const filename = resolveString(d.data.filename) || "";
     const moduleName = resolveString(d.data.module) || "";
     const displayName = escapeHtml(useModuleNames ? (moduleName || filename) : filename);

Lib/profiling/sampling/stack_collector.py

@@ -401,7 +401,10 @@ def _get_source_lines(self, func):
             return None
 
     def _create_flamegraph_html(self, data):
-        data_json = json.dumps(data)
+        data_json = (json.dumps(data)
+                     .replace("<", "\\u003c")
+                     .replace(">", "\\u003e")
+                     .replace("&", "\\u0026"))
 
         template_dir = importlib.resources.files(__package__)
         vendor_dir = template_dir / "_vendor"

Misc/NEWS.d/next/Library/2026-07-17-14-00-00.gh-issue-153840.FgXs3e.rst

@@ -0,0 +1,3 @@
+Escape special characters in ``profiling.sampling`` flamegraph function
+names to prevent markup injection in the generated HTML report.  Patch by
+tonghuaroot.