[pritesh-jain-cstk]

Summary

The default JSON RTE → HTML renderer (Utils.JsonToHtml, Utils.GQL.JsonToHtml) and the default Options renderer wrote RTE content into HTML without escaping it. This PR escapes it by default, the same way the Java Utils SDK already does, and adds an opt-out so a front end can go back to the previous output if needed.

Approach: parity with Java Utils

Concern	Java Utils	This PR (.NET)
Text nodes	escapes & < >	same
Attribute values incl. href/src	StringEscapeUtils.escapeHtml4	System.Net.WebUtility.HtmlEncode (built into .NET, no new dependency)
URL schemes	unchanged	unchanged

There's no hand-written encoder and no URL rewriting.

Changes

• Options.EscapeHtml (new, default true). false restores the 2.0.x output byte-for-byte; tests check this.
• Options.EscapeText / Options.EscapeAttribute (new, public): helpers for custom renderers. They follow EscapeHtml.
• Text nodes are escaped before marks are applied. Attributes written by RenderNode, RenderMark and RenderOption are encoded. Embedded entry/asset titles, UIDs and link text are escaped; for HTML RTE, link text is entity-decoded once first, so it isn't double-escaped.
• Version 2.1.0: CHANGELOG entry with a Behavior change section. The README has a new "HTML escaping" section, and the custom-renderer sample now uses the helpers.

Behavior changes (release notes)

• HTML typed as text in JSON RTE text nodes now displays as text, as in Java and JS Utils.
• RenderMark now receives escaped text, and the RenderNode children callback returns escaped HTML. Custom renderers that escaped these themselves should stop, or set EscapeHtml = false.
• & in URLs is written as &, and non-ASCII characters in attributes may be written as numeric entities. Browsers read both the same.
• Utils.RenderContent (HTML RTE) output is unchanged apart from the embedded objects it replaces.

Tests

• HtmlEncodingTest.cs: 34 cases covering text, marks, attributes, embedded objects, HTML RTE link text, EscapeHtml = false and the helpers.
• CI: 327 / 327 passed (293 existing + 34 new). No existing expectation changed.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.