From a95dfd010f973db05f8c5107ca4227a83a784349 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Danielle=20For=C3=A9?= <danielle@elementary.io>
Date: Tue, 3 Feb 2026 15:03:53 -0800
Subject: [PATCH] AgendaEventRow: escape location description text

---
 core/Utils.vala                 | 7 +++++++
 src/Widgets/AgendaEventRow.vala | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/core/Utils.vala b/core/Utils.vala
index d3dcb2a83..70c58201f 100644
--- a/core/Utils.vala
+++ b/core/Utils.vala
@@ -100,4 +100,11 @@ namespace Maya.Util {
         var result = original_uid.dup ();
         return result.reverse ();
     }
+
+    public static string escape_markup (string escaped_text) {
+        return escaped_text.replace ("&", "&amp;")
+                           .replace ("<", "&lt;")
+                           .replace (">", "&gt;")
+                           .replace ("'", "&#39;");
+    }
 }
diff --git a/src/Widgets/AgendaEventRow.vala b/src/Widgets/AgendaEventRow.vala
index 80e39b599..6e531bd0f 100644
--- a/src/Widgets/AgendaEventRow.vala
+++ b/src/Widgets/AgendaEventRow.vala
@@ -373,7 +373,7 @@ public class Maya.View.AgendaEventRow : Gtk.ListBoxRow {
         string location_description, location_uri;
         if (location_from_component (event, out location_description, out location_uri)) {
             if (location_uri != "") {
-                location_label.label = "<a href=\"%s\">%s</a>".printf (location_uri, location_description);
+                location_label.label = "<a href=\"%s\">%s</a>".printf (location_uri, Util.escape_markup (location_description));
             } else {
                 location_label.label = location_description;
             }