From 0cf8108ff08d48c7720a67c6b4deaa1b32b62eeb Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sun, 31 May 2026 03:03:31 +0000
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]?=
 =?UTF-8?q?=20Fix=20XSS=20vulnerability=20in=20search.html=20escapeHtml?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 frontend/templates/search.html | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/frontend/templates/search.html b/frontend/templates/search.html
index 89ad5cb7..8f986b38 100644
--- a/frontend/templates/search.html
+++ b/frontend/templates/search.html
@@ -298,9 +298,13 @@
   }
 
   function escapeHtml(str) {
-    const d = document.createElement('div');
-    d.textContent = str;
-    return d.innerHTML;
+    if (!str) return '';
+    return String(str)
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&#039;');
   }
 
   /**

From 37c27c02139ae4a462e1705bda9360b23eb835b3 Mon Sep 17 00:00:00 2001
From: Christian Krakau-Louis <christian@Christians-Mac-mini-7.local>
Date: Sun, 31 May 2026 05:38:41 +0200
Subject: [PATCH 2/2] fix: preserve falsy values in escapeHtml

---
 frontend/templates/search.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/templates/search.html b/frontend/templates/search.html
index 8f986b38..28cb0dfc 100644
--- a/frontend/templates/search.html
+++ b/frontend/templates/search.html
@@ -298,7 +298,7 @@
   }
 
   function escapeHtml(str) {
-    if (!str) return '';
+    if (str === null || str === undefined) return '';
     return String(str)
       .replace(/&/g, '&amp;')
       .replace(/</g, '&lt;')