An app generates a PDF based on user entered data in text fields. Copying and pasting users can inadvertently end up pasting "tags" in the field. Eg -
The PDF generator plugin does not like this and crashes throwing an exception. The App vendor says this "escaping needs to be done on the plugin side" as all their tools/plugins are similar - escaping for sql injection, cross site etc. The plugin vendor says the App vendor needs to escape the tags.
My initial thoughts are that this is not enough for a catastrophic error that the plugin throws. I would have liked a PDF to still be generated but with a message "Something went wrong, problem with..." or just ignore the unknown tag and show it as is in the PDF (I've seen this before in a business app). But I'm not sure which side this nice error handling falls on.
In terms of software design, app vs plugin, which side is responsible objectively in this case?
App takes data from the database (originally user entered) and prepares a basic HTML string for conversion, eg in a the App's controller action:
$html = "<html>...<p>$userNotes</p>...</html>"; return Response($this->plugin->htmlToPDF($html));