From 6eeb83ea5e4ff2c97c4f0ce1ccac324687802b69 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
<161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Thu, 28 May 2026 03:07:41 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?=
=?UTF-8?q?x=20DOM-based=20XSS=20in=20file=20upload?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
- Added `_escapeHtml` helper to sanitize user-controlled file name.
- Used it to sanitize `file.name` before appending it to `row.innerHTML`.
- Applied changes to `frontend/static/js/upload.js`.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
frontend/static/js/upload.js | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/frontend/static/js/upload.js b/frontend/static/js/upload.js
index b8ecd62a..beb33e3e 100644
--- a/frontend/static/js/upload.js
+++ b/frontend/static/js/upload.js
@@ -169,6 +169,21 @@ function _onUploadSuccess() {
}
}
+/**
+ * Helper to sanitize strings before injecting into HTML.
+ * @param {string} str
+ * @returns {string}
+ */
+function _escapeHtml(str) {
+ if (!str) return '';
+ return String(str)
+ .replace(/&/g, '&')
+ .replace(//g, '>')
+ .replace(/"/g, '"')
+ .replace(/'/g, ''');
+}
+
// ── Directory traversal helpers ───────────────────────────────────────────────
/**
@@ -297,9 +312,10 @@ function processFiles(files, progressContainer, statusMessage) {
const queueItems = fileArray.map((file) => {
const row = document.createElement('div');
row.className = 'flex flex-col mb-2';
+ const safeName = _escapeHtml(file.name);
row.innerHTML = `
- ${file.name}
+ ${safeName}
${formatFileSize(file.size)}