From 8f3cec85aa29b2b13fed9b2f8e499e1ac9b0504c Mon Sep 17 00:00:00 2001
From: veygax <84923630+veygax@users.noreply.github.com>
Date: Fri, 30 Jan 2026 21:12:00 +0000
Subject: [PATCH] Merge commit from fork

Signed-off-by: Evan Lambert <veyga@veygax.dev>
---
 app/assets/web/main.js | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/app/assets/web/main.js b/app/assets/web/main.js
index a33b17e7..db5481dc 100644
--- a/app/assets/web/main.js
+++ b/app/assets/web/main.js
@@ -129,7 +129,7 @@ function handleFilesDisplay(files, sessionId) {
     var file = files[fileKeys[i]];
     html += '<a class="file-item" href="' + BASE_URL + '/download?sessionId=' + encodeURIComponent(sessionId) + '&fileId=' + encodeURIComponent(fileKeys[i]) + '">' +
         '<div class="file-index-cell">' + (i + 1) + '</div>' +
-        '<div class="file-name-cell">' + file.fileName + '</div>' +
+        '<div class="file-name-cell">' + escapeHtml(file.fileName) + '</div>' +
         '<div class="file-size-cell">' + formatBytes(file.size) + '</div>' +
         '</a>';
   }
@@ -141,6 +141,20 @@ function handleFilesDisplay(files, sessionId) {
   }
 }
 
+function escapeHtml(text) {
+  if (text === null || text === undefined) {
+    return '';
+  }
+  var map = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#039;'
+  };
+  return String(text).replace(/[&<>"']/g, function(m) { return map[m]; });
+}
+
 function formatBytes(bytes) {
   if (bytes < 1024) {
     return bytes + ' B';