[1.0.x] Node Alias Link Display

I did a quick review, I didn't find any serious security issue but still need to sanitize alias and original parts before replacing, and maybe add $node->access() to check node access.
Something like:

if (is_numeric($nid)) {
  $node = $this->entityTypeManager->getStorage('node')->load($nid);
  if ($node instanceof Node && $node->access()) {
    $language = $this->languageManager->getLanguage($langcode);
    $node_url = $node->toUrl('canonical', ['language' => $language]);
    $alias = $node_url->toString();

    if ($alias !== "/node/$nid") {
      // Sanitize alias and original parts before replacing
      $safe_original = Xss::filter($original);
      $safe_alias = Html::escape($alias);
      $safe_url = Html::escape($url);

      return str_replace($safe_url, $safe_alias, $safe_original);
    }
  }
}
return Html::escape($original);

Thank you @iheb.attia for your contribution and explications.
It's clear, since there is no other security issue, i will move this to fixed!

These issues are fixed only when the applicant gets the role that allows to opt projects into security advisory coverage. That can only be done by project moderators.

I am changing the issue priority as per issue priorities.

Actually, this project does not have enough Drupal code, differently from the other one. We should continue with the other application.