From cd5876dc547a882491be89e8b56a6695b4ffaaa5 Mon Sep 17 00:00:00 2001
From: Benjamin Nauck <benjamin@nauck.se>
Date: Mon, 9 Mar 2026 21:37:41 +0100
Subject: [PATCH] Sketcher: Escape text and font path in EditTextDialog

Escape user-provided text and font path strings before inserting them
into the Python command string, preventing breakage or injection from
strings containing quotes or backslashes.
---
 src/Mod/Sketcher/Gui/EditTextDialog.cpp | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/Mod/Sketcher/Gui/EditTextDialog.cpp b/src/Mod/Sketcher/Gui/EditTextDialog.cpp
index d17442fe8a..4d7c1d9901 100644
--- a/src/Mod/Sketcher/Gui/EditTextDialog.cpp
+++ b/src/Mod/Sketcher/Gui/EditTextDialog.cpp
@@ -30,6 +30,7 @@
 #include <Gui/CommandT.h>
 #include <Mod/Sketcher/App/SketchObject.h>
 
+#include "CommandConstraints.h"
 #include "EditTextDialog.h"
 #include "ViewProviderSketch.h"
 #include "Utils.h"
@@ -114,12 +115,14 @@ void EditTextDialog::on_buttonBox_accepted()
         }
 
         // Send the updated 5-parameter call to Python
+        std::string escText = escapeForPython(newText);
+        std::string escFont = escapeForPython(newFontPath);
         Gui::cmdAppObjectArgs(
             sketch,
             "setTextAndFont(%i, '%s', '%s', %s, %s)",
             constrIndex,
-            newText.c_str(),
-            newFontPath.c_str(),
+            escText.c_str(),
+            escFont.c_str(),
             newIsHeight ? "True" : "False",
             isConstruction ? "True" : "False"
         );