From f0304a9213ab28d5273ef4e872c0c6b26ef94cb6 Mon Sep 17 00:00:00 2001
From: zolaski333 <az3r33r@gmail.com>
Date: Sat, 17 Oct 2026 21:33:29 +0200
Subject: [PATCH] gh-159640: Escape profile data embedded in flamegraph HTML

---
 Lib/profiling/sampling/stack_collector.py     |  4 +++
 .../test_sampling_profiler/test_collectors.py | 30 +++++++++++++++++++
 ...17-21-30-00.gh-issue-159640.flamegraph.rst |  2 ++
 3 files changed, 36 insertions(+)
 create mode 100644 Misc/NEWS.d/next/Library/2026-10-17-21-30-00.gh-issue-159640.flamegraph.rst

diff --git a/Lib/profiling/sampling/stack_collector.py b/Lib/profiling/sampling/stack_collector.py
index 60061b4a2ecf111..0c754c3598b57c2 100644
--- a/Lib/profiling/sampling/stack_collector.py
+++ b/Lib/profiling/sampling/stack_collector.py
@@ -505,6 +505,10 @@ def _create_flamegraph_html(self, data):
             # Python recursion limit. iterencode() uses the Python encoder.
             data_json = "".join(json.JSONEncoder().iterencode(data))
 
+        # Prevent profile strings from closing the script element or starting
+        # an HTML comment, while preserving their values in JavaScript.
+        data_json = data_json.replace("<", "\\u003c")
+
         template_dir = importlib.resources.files(__package__)
         vendor_dir = template_dir / "_vendor"
         assets_dir = template_dir / "_assets"
diff --git a/Lib/test/test_profiling/test_sampling_profiler/test_collectors.py b/Lib/test/test_profiling/test_sampling_profiler/test_collectors.py
index d4ba2df5044559f..a8c99fc5b29a136 100644
--- a/Lib/test/test_profiling/test_sampling_profiler/test_collectors.py
+++ b/Lib/test/test_profiling/test_sampling_profiler/test_collectors.py
@@ -7,6 +7,7 @@
 import sys
 import tempfile
 import unittest
+from unittest import mock
 
 from test.support import is_emscripten, run_with_limited_c_stack, set_recursion_limit
 
@@ -596,6 +597,35 @@ def test_flamegraph_collector_export(self):
         self.assertIn('"sample_interval_usec": 10000', content)
         self.assertIn("samples * data.stats.sample_interval_usec / 1000", content)
 
+    def test_flamegraph_html_escapes_script_data(self):
+        collector = FlamegraphCollector(1000)
+        data = {
+            "strings": [
+                "</script><script>alert(1)</script>",
+                "</ScRiPt \t><script>alert(2)</script>",
+                "<!--<script>",
+                "<>&\u2028\u2029",
+                'quotes " and \\ and \\u003c',
+                "计算\udc80",
+            ],
+            "stats": {},
+        }
+        for side_effect in (None, RecursionError):
+            with self.subTest(side_effect=side_effect):
+                # Also exercise the fallback used for deeply nested profiles.
+                with mock.patch(
+                    "profiling.sampling.stack_collector.json.dumps",
+                    wraps=json.dumps,
+                    side_effect=side_effect,
+                ):
+                    content = collector._create_flamegraph_html(data)
+                embedded_data = content.split("const EMBEDDED_DATA = ", 1)[1]
+                embedded_data = embedded_data.split(";\n", 1)[0]
+                self.assertNotIn("<", embedded_data)
+                self.assertNotIn("\u2028", embedded_data)
+                self.assertNotIn("\u2029", embedded_data)
+                self.assertEqual(json.loads(embedded_data), data)
+
     def test_flamegraph_collector_empty_export_fails(self):
         """Test empty flamegraph export reports no output."""
         flamegraph_out = tempfile.NamedTemporaryFile(
diff --git a/Misc/NEWS.d/next/Library/2026-10-17-21-30-00.gh-issue-159640.flamegraph.rst b/Misc/NEWS.d/next/Library/2026-10-17-21-30-00.gh-issue-159640.flamegraph.rst
new file mode 100644
index 000000000000000..41748a1b4e8337b
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-10-17-21-30-00.gh-issue-159640.flamegraph.rst
@@ -0,0 +1,2 @@
+Escape profile data embedded in sampling profiler flamegraph reports to
+prevent strings containing ``</script>`` from breaking the generated HTML.