fix: escHtml для всех innerHTML (XSS)

2026-06-28 10:24:10 +04:00
parent 992f833880
commit f985f369fb
2 changed files with 4 additions and 4 deletions
@@ -212,7 +212,7 @@ function startCompareSSE(url, container, statusEl, callbacks) {
    // ── extract_error / apply_error: показать ошибку ──
    else if (d.type === 'extract_error' || d.type === 'apply_error') {
      applyCompareEvent(sections, d);
-      container.innerHTML += '<div style="font-size:12px;color:var(--destructive);">✗ ' + d.filename + ': ' + d.error + '</div>';
+      container.innerHTML += '<div style="font-size:12px;color:var(--destructive);">✗ ' + escHtml(d.filename) + ': ' + escHtml(d.error) + '</div>';
    }

    // ── done: завершение ──