PROD-2253

common/lib/xmodule/xmodule/block_metadata_utils.py

@@ -6,6 +6,8 @@ allows us to share code between the XModuleMixin and CourseOverview and
 BlockStructure.
 """
 
+from markupsafe import escape
+
 
 def url_name_for_block(block):
     """
@@ -77,4 +79,4 @@ def display_name_with_default_escaped(block):
     # This escaping is incomplete.  However, rather than switching this to use
     # markupsafe.escape() and fixing issues, better to put that energy toward
     # migrating away from this method altogether.
-    return display_name_with_default(block).replace('<', '&lt;').replace('>', '&gt;')
+    return escape(display_name_with_default(block))