From 35039c8463921a4d86e95e5b6e77423357316757 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Thu, 28 May 2026 03:10:12 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?=
 =?UTF-8?q?x=20DOM-based=20XSS=20in=20file=20upload?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Added `_escapeHtml` helper to sanitize user-controlled file name.
- Used it to sanitize `file.name` before appending it to `row.innerHTML`.
- Applied changes to `frontend/static/js/upload.js`.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>