Fix HTML escaping in completion

doc/changelog.asciidoc

@@ -40,6 +40,7 @@ Fixed
 - Fixed workaround for black screens with Nvidia cards
 - Mark the content.notifications setting as QtWebKit only correctly
 - Handle a filesystem going read-only gracefully
+- Fix wrong rendering of keys like `<back>` in the completion
 
 v1.0.1
 ------

qutebrowser/completion/completiondelegate.py

@@ -202,7 +202,8 @@ class CompletionItemDelegate(QStyledItemDelegate):
             if index.column() in columns_to_filter and pattern:
                 repl = r'<span class="highlight">\g<0></span>'
                 text = re.sub(re.escape(pattern).replace(r'\ ', r'|'),
-                              repl, self._opt.text, flags=re.IGNORECASE)
+                              repl, html.escape(self._opt.text),
+                              flags=re.IGNORECASE)
                 self._doc.setHtml(text)
             else:
                 self._doc.setPlainText(self._opt.text)