Escape root profile name in HtmlDumper

CHANGELOG

@@ -1,6 +1,7 @@
 # 3.27.0 (2026-XX-XX)
 
  * Restrict allowed classes in `Twig\Profiler\Profile::unserialize()` to prevent arbitrary class instantiation
+ * Escape root profile name in `HtmlDumper`
  * Deprecate the `Twig\Sandbox\SourcePolicyInterface` interface with no replacement
 
 # 3.26.0 (2026-05-20)

src/Profiler/Dumper/BaseDumper.php

@@ -31,11 +31,16 @@ abstract class BaseDumper
 
     abstract protected function formatTime(Profile $profile, $percent): string;
 
+    protected function formatRoot(Profile $profile): string
+    {
+        return $profile->getName();
+    }
+
     private function dumpProfile(Profile $profile, $prefix = '', $sibling = false): string
     {
         if ($profile->isRoot()) {
             $this->root = $profile->getDuration();
-            $start = $profile->getName();
+            $start = $this->formatRoot($profile);
         } else {
             if ($profile->isTemplate()) {
                 $start = $this->formatTemplate($profile, $prefix);

src/Profiler/Dumper/HtmlDumper.php

@@ -30,6 +30,11 @@ final class HtmlDumper extends BaseDumper
         return '<pre>'.parent::dump($profile).'</pre>';
     }
 
+    protected function formatRoot(Profile $profile): string
+    {
+        return self::escape($profile->getName());
+    }
+
     protected function formatTemplate(Profile $profile, $prefix): string
     {
         return \sprintf('%s└ <span style="background-color: %s">%s</span>', $prefix, self::$colors['template'], self::escape($profile->getTemplate()));

tests/Profiler/Dumper/HtmlTest.php

@@ -59,4 +59,14 @@ EOF, $dumper->dump($this->getProfile()));
         $this->assertStringContainsString('<img src=x onerror=alert(2)>', $output);
         $this->assertStringContainsString('<img src=x onerror=alert(3)>', $output);
     }
+
+    public function testDumpEscapesRootProfileName()
+    {
+        $root = new Profile('template-name', Profile::ROOT, '<img src=x onerror=alert(1)>');
+
+        $output = (new HtmlDumper())->dump($root);
+
+        $this->assertStringNotContainsString('<img src=x onerror=alert(1)>', $output);
+        $this->assertStringContainsString('&lt;img src=x onerror=alert(1)&gt;', $output);
+    }
 }