From f985f369fb8e1e41804d1300c76816e4de185404 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9CNaeel=E2=80=9D?= <tazet@narod.ru>
Date: Sun, 28 Jun 2026 10:24:10 +0400
Subject: [PATCH] =?UTF-8?q?fix:=20escHtml=20=D0=B4=D0=BB=D1=8F=20=D0=B2?=
 =?UTF-8?q?=D1=81=D0=B5=D1=85=20innerHTML=20(XSS)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 site/static/app.js     | 6 +++---
 site/static/compare.js | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/site/static/app.js b/site/static/app.js
index c0447cd..08c2b63 100644
--- a/site/static/app.js
+++ b/site/static/app.js
@@ -203,7 +203,7 @@ async function runClassify() {
     if (!classifyDone) {
       clearInterval(timer);
       clearInterval(pollTimer);
-      btn.innerHTML = '✗ ' + e.message;
+      btn.innerHTML = '✗ ' + escHtml(e.message);
       btn.disabled = false;
     }
   }
@@ -291,7 +291,7 @@ window.runCompareForGroup = async function(gi, btn) {
         state._activeCompare.timer = null;
         state._activeCompare.es = null;
         group.compare = null;
-        cmpBody.innerHTML += '<div style="color:var(--destructive);">✗ ' + d.message + '</div>';
+        cmpBody.innerHTML += '<div style="color:var(--destructive);">✗ ' + escHtml(d.message) + '</div>';
         btn.innerHTML = '✗'; btn.disabled = false;
         document.querySelectorAll('.cmp-btn').forEach(function(b) { b.disabled = false; });
       },
@@ -340,7 +340,7 @@ document.getElementById('llmBtn').addEventListener('click', function() {
       lucide.createIcons();
     },
     onError: function(d) {
-      compareBody.innerHTML += '<div style="color:var(--destructive);margin-top:8px;">✗ ' + d.message + '</div>';
+      compareBody.innerHTML += '<div style="color:var(--destructive);margin-top:8px;">✗ ' + escHtml(d.message) + '</div>';
       btn.innerHTML = '<i data-lucide="scale" style="width:16px;height:16px;"></i> Общее сравнение';
       btn.disabled = false;
     },
diff --git a/site/static/compare.js b/site/static/compare.js
index c712478..23daa56 100644
--- a/site/static/compare.js
+++ b/site/static/compare.js
@@ -212,7 +212,7 @@ function startCompareSSE(url, container, statusEl, callbacks) {
     // ── extract_error / apply_error: показать ошибку ──
     else if (d.type === 'extract_error' || d.type === 'apply_error') {
       applyCompareEvent(sections, d);
-      container.innerHTML += '<div style="font-size:12px;color:var(--destructive);">✗ ' + d.filename + ': ' + d.error + '</div>';
+      container.innerHTML += '<div style="font-size:12px;color:var(--destructive);">✗ ' + escHtml(d.filename) + ': ' + escHtml(d.error) + '</div>';
     }
 
     // ── done: завершение ──