From 907346941602605b547d24178c4e1695afe7d34f Mon Sep 17 00:00:00 2001
From: Kam <erkamyaman35@gmail.com>
Date: Sun, 6 Sep 2026 02:07:14 +0300
Subject: [PATCH] fix(docs-infra): escape the code example header

`buildHeaderElement` interpolated the header into a string that is then parsed
as HTML, so markup in a header became an element instead of text. The ten
captions on https://angular.dev/guide/i18n/translation-files read
`messages.fr.xlf ()`, having turned `(<trans-unit>)` into an empty element.

These are the only two headers in the guides containing markup.
---
 .../shared/marked/extensions/docs-code/format/index.mts    | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/adev/shared-docs/pipeline/shared/marked/extensions/docs-code/format/index.mts b/adev/shared-docs/pipeline/shared/marked/extensions/docs-code/format/index.mts
index 88f3fbaed4e..c107addc003 100644
--- a/adev/shared-docs/pipeline/shared/marked/extensions/docs-code/format/index.mts
+++ b/adev/shared-docs/pipeline/shared/marked/extensions/docs-code/format/index.mts
@@ -96,6 +96,11 @@ export function processForApiLinks(fragment: Element, apiEntries: ApiEntries): v
   });
 }
 
+/** Escapes text that is interpolated into an HTML string. */
+function escapeHtml(text: string): string {
+  return text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
 /** Build the header element if a header is provided in the token. */
 function buildHeaderElement(token: CodeToken) {
   let header = '';
@@ -104,7 +109,7 @@ function buildHeaderElement(token: CodeToken) {
   }
 
   if (token.header) {
-    header += `<h3>${token.header}</h3>`;
+    header += `<h3>${escapeHtml(token.header)}</h3>`;
   }
 
   if (!header) return '';