🛡️ Sentinel: [HIGH] Fix XSS in upload.js

Added an `_escapeHtml` function to properly sanitize `file.name` before it is dynamically rendered into the DOM using `row.innerHTML`. This mitigates a DOM-based Cross-Site Scripting (XSS) vulnerability.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

frontend/static/js/upload.js

@@ -293,13 +293,25 @@ function processFiles(files, progressContainer, statusMessage) {
     updateStatus();
   }
 
+  function _escapeHtml(unsafe) {
+    if (!unsafe) return '';
+    return String(unsafe)
+      .replace(/&/g, "&")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;")
+      .replace(/"/g, "&quot;")
+      .replace(/'/g, "&#039;");
+  }
+
   // Pre-create one progress row per file.
   const queueItems = fileArray.map((file) => {
     const row = document.createElement('div');
     row.className = 'flex flex-col mb-2';
+    const safeFileName = _escapeHtml(file.name);
+
     row.innerHTML = `
       <div class="flex justify-between">
-        <span class="text-sm truncate" title="${file.name}">${file.name}</span>
+        <span class="text-sm truncate" title="${safeFileName}">${safeFileName}</span>
         <span class="text-xs text-gray-500">${formatFileSize(file.size)}</span>
       </div>
       <div class="w-full bg-gray-200 h-2 rounded-full mt-1">