escape data in calendar popover (#2960)

assets/js/plugins/KimaiEscape.js

@@ -0,0 +1,35 @@
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+/*!
+ * [KIMAI] KimaiEscape: sanitize strings
+ */
+
+import KimaiPlugin from "../KimaiPlugin";
+
+export default class KimaiEscape extends KimaiPlugin {
+
+    getId() {
+        return 'escape';
+    }
+
+    /**
+     * @param {string} title
+     * @returns {string}
+     */
+    escapeForHtml(title) {
+        const tagsToReplace = {
+            '&': '&',
+            '<': '&lt;',
+            '>': '&gt;',
+        };
+
+        return title.replace(/[&<>]/g, function(tag) {
+            return tagsToReplace[tag] || tag;
+        });
+    };
+}