Christian Krakau-Louis
00ec6888c5
* 🛡️ Sentinel: [HIGH] Fix DOM-based XSS in upload.js Added `_escapeHtml` function to sanitize user-controlled `file.name` before interpolating it into the `row.innerHTML` payload, preventing malicious file names from executing XSS during uploads. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> * Tighten XSS fix PR payload --------- Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com> Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> Co-authored-by: Christian Krakau-Louis <christian@Christians-Mac-mini-7.local>