Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Bug: HTML entity replacements missing semicolons (&lt/&gt) — sliced entities render as garbage text in typed-word overlay

Open Beginner friendly
  • Is something wrong?
#8,365 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@boergeson is already working on this.

Since Aug 29, 2026.

  • #8378 by @boergeson — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
84/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
typescript
Domain
frontend

Research direction

Start by reading the two call sites in frontend/src/ts/test/result-word-highlight.ts and frontend/src/ts/test/test-ui.ts, then inspect Misc.escapeHTML in utils/misc.ts:137-145. Ensure both overlay paths escape the angle brackets before slicing without producing truncated entity text, and verify the reproduction no longer renders raw fragments such as &l.

Written by the indexing model from the issue text.

Description

Did you clear cache before opening an issue?
  • I have cleared my cache
Is there an existing issue for this?
  • I have searched the existing open and closed issues
Does the issue happen when logged in?

Yes

Does the issue happen when logged out?

Yes

Does the issue happen in incognito mode when logged in?

Yes

Does the issue happen in incognito mode when logged out?

Yes

Issue details

Current Behavior

Two spots replace < / > with HTML entities but omit the trailing semicolon, producing non-standard references that interact badly with .slice():

// frontend/src/ts/test/result-word-highlight.ts:314-319
inputWordEl.innerHTML = userInputString
  .replace(/\t/g, "_")
  .replace(/</g, "&lt") // no semicolon
  .replace(/>/g, "&gt") // no semicolon
  .slice(0, wordEl.childElementCount);

// frontend/src/ts/test/test-ui.ts:1405-1409 — same pattern

Because the slice happens after replacement, input ending in < gets truncated mid-entity (e.g. &l), which then renders as literal garbage text instead of <. Legacy-style semicolon-less entities also double-decode oddly when adjacent entity-like text exists in the typed string.

Expected Behavior

Replace before slicing with proper entities (or escape after slicing):

.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")

Ideally both call sites would share one escaping helper (e.g. reuse Misc.escapeHTML from utils/misc.ts:137-145, which already escapes correctly).

Steps To Reproduce
  1. Type a word containing < such that the input length exceeds the word length so .slice() cuts inside the appended entity (e.g. type abc< against word xyz).
  2. Observe raw &l fragments rendered in the input overlay instead of the < character.
Environment
  • OS: Any
  • Browser: Any
  • Found via source review of master @ 91bd24bb8
Dominant language
TypeScript
Stars
20.8k
Forks
3.4k
Avg merge
1d 52m
Merged PRs (30d)
2

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from monkeytypegame/monkeytype

All issues in monkeytypegame/monkeytype

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.