Bug report: HTML not escaped properly

[ghost]

Summary

When building an HTML options list the value is not escaped. This causes some of the value to be displayed in the name.

Example

This is a problem for RegExs because some contain a " followed by a > which causes part of the regex to appear in the name because the HTML is parsed incorrectly, as shown below.

Link to show bug

This issue comes from Line 159 and is present in other places, where the HTML value is not escaped, but the values don't trigger it

CyberChef/src/web/HTMLIngredient.mjs

Line 159 in 6f8a5ea

html += `<option populate-value="${this.value[i].value}">${this.value[i].name}</option>`;

[n1474335]

Good spot, thanks. This has now been fixed in v8.23.4.