Is generating docfx XSS secure?

[NeuroXiq]

Hello, I just got a question about XSS when generating docs.
Unfortunately I don't have good understanding of the documents generation process therefore I wish to know
if XSS is possible in my scenation. Scenario is very simple.
Lets say following:

1. I have unknown .NET EXAMPLE.dll assembly (this is valid assembly, with valid code, runtime can load & run this)
2. I have unknown EXMAPLE.xml documentation for this assembly (this is valid .xml file with valid documentation)

I create default DocFX template and put this into bin folder and just generate docs.
So my question: In this scenarion is this possible that some malicious JS code will be injected into generated docs?

For example some JS code inside .xml file or JS inside some attributes in .dll assembly or something like this?
Is this possible that anything in .xml or .dll DocFX will treat like JS code and inject it into HTML
or it always treat it as a text to display during generation of HTML pages?

Thank you in advance for your help
Best Regards
Marek

[filzrev]

Is this possible that anything in .xml or .dll DocFX will treat like JS code and inject it into HTML
or it always treat it as a text to display during generation of HTML pages?

As far as I've confirmed.
It can inject custom script from documentation XML files.

Test Steps

1. Create test project and define Sample class with summary doc comment that contains script tag.

namespace test;

/// <summary>
/// Summary <see cref="Sample" />
/// <script>
///   alert('test');
/// </script>
/// </summary>
public class Sample
{
}

2. Enable <GenerateDocumentationFile> MSBuild property.
3. Build project and copy dll/xml files to docfx metadata src directory
4. Run docfx metadata command (I've tested on both mref/apiPage outputFormat)
5. Run docfx build --serve command
6. Navigate to Sample API page.
7. Confirm alert dialog is displayed by injected script.

Generated summary HTML tags

<div class="markdown summary">Summary <a class="xref" href="test.Sample.html">Sample</a><script> alert('test'); </script></div>

[KalleOlaviNiemitalo]

DocFX v3 had src/docfx/lib/HtmlSanitizer.cs (#5823, #7587) but that does not exist in v2.