Apply proper HTML escaping

src/jinja2/html.j2

@@ -2,24 +2,24 @@
 <div class="event assert v_{{A.verdict}}">
     &nbsp;
     <div class="hint">
-        <span class="verdict">{{A.verdict}}</span>{{A.hint}}
+        <span class="verdict">{{A.verdict}}</span>{{A.hint|e}}
     </div>
-    {% if A.data %}<pre class="data">{{A.data}}</pre>{% endif %}
+    {% if A.data %}<pre class="data">{{A.data|e}}</pre>{% endif %}
  </div>
 {%- endmacro %}
 
 {% macro message(M) -%}
 <div class="event message s_{{M.severity}}">
     <div class="severity">{{M.severity}}</div>
-    <pre class="message">{{M.message}}</pre>
-    {% if M.data %}<pre class="data">{{M.data}}</pre>{% endif %}
+    <pre class="message">{{M.message|e}}</pre>
+    {% if M.data %}<pre class="data">{{M.data|e}}</pre>{% endif %}
  </div>
 {%- endmacro %}
 
 {% macro phase(P) -%}
 <div class="phase v_{{P.verdict}}">
     <div class="name p_{{P.type}}">
-        <span class="verdict">{{P.verdict}}</span>{{P.name}}
+        <span class="verdict">{{P.verdict}}</span>{{P.name|e}}
     </div>
     {% for e in P.children %}
         {% if e.is_assert %}
@@ -69,7 +69,7 @@
 
         <div class="lints">
             {% for lint in session.lints %}
-                <div class="lint">{{ lint.msg }} <code>{{ lint._data }}</code></div>
+                <div class="lint">{{ lint.msg|e }} <code>{{ lint._data|e }}</code></div>
             {% endfor %}
         </div>