This commit resolves a DOM-based Cross-Site Scripting (XSS) vulnerability in `frontend/static/js/upload.js`. Previously, the user-controlled `file.name` was directly interpolated into the DOM using `innerHTML` without any HTML entity escaping. A maliciously crafted filename could lead to script execution.
A local `_escapeHtml` function has been introduced to safely escape characters like `<`, `>`, `&`, `"`, and `'` before rendering.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
google-labs-jules[bot]
5f530a28b3