Fix: DataTable JavaScript serialization vulnerability in caption

[turfin-logic]

Replaced manual string quoting with \json.dumps\ to prevent Javascript syntax errors when the caption contains quotes, backslashes, or newlines. Fixes #500.

[redimp]

Hey @turfin-logic, thanks for this PR.

Using json.dumps() for escaping here is a good idea.

Please give an example which of the issues in #500 it solves.

[turfin-logic]

Hey @redimp! This specific PR fixes the Table caption parsing vulnerability mentioned in #500. Specifically, if a user created a table with a malicious caption containing unescaped quotes or JavaScript payloads, the previous string formatting logic in otterwiki/formatter.py would inject it directly into the DataTables initialization script, allowing XSS. Using json.dumps() ensures the caption is safely serialized as a valid JavaScript string literal regardless of its contents. Let me know if you need a specific payload example!

[redimp]

Got it. You're referring to your comment and this PR is a fix for the problem with caption. But #500 has other issues as well and those are not fixed.

The note

Fixes #500

is a bit misleading.