Fix g-flag regex in getValidId and CSS selector injection in getIdFromUrl

[vincentfretin]

Allow id starting with _ in isValidId

id starting with _ is valid

Regex missing g flag in getValidId

The .replace(/\s/, '-') and .replace(/[\W]/, '') calls only replaced the first match because they were missing the g (global) flag.

Example with filename "9 -8 cool test.jpg":

Old (no g flag):

"9 -8 cool test"    → split('.').shift()
"9--8 cool test"    → replace(/\s/, '-')     — only first space replaced
"--8 cool test"     → replace(/^\d+\s*/, '') — strips "9"
"-8 cool test"      → replace(/[\W]/, '')    — removes first '-'

Result: "8 cool test" — starts with a digit and has spaces, invalid CSS selector ID.

New:

"9 -8 cool test"    → split('.').shift()
"9--8-cool-test"    → replace(/\s+/g, '-')      — spaces → hyphens
"9--8-cool-test"    → replace(/[^\w-]+/g, '')    — nothing to remove here
"cool-test"         → replace(/^[-\d]+/, '')     — strips leading "9--8-"

Result: "cool-test" — valid, and preserves word separation with hyphens.

CSS selector injection in getIdFromUrl

If url contains a single quote, the querySelector call throws a SyntaxError:

// Old code:
document.querySelector("a-assets > [src='" + url + "']")

With a URL like https://example.com/it's-a-photo.jpg, the browser does NOT encode
the ' in the src attribute, so the selector becomes invalid:

a-assets > [src='https://example.com/it's-a-photo.jpg']
                                        ^ breaks here

Fix: Escape single quotes before interpolating into the selector:

const escaped = url.replace(/'/g, "\\'");
document.querySelector(`a-assets > [src='${escaped}']`)

Vincent: I tested that one in the console:

const img=document.createElement('img')
img.src = "https://example.com/it's-a-photo.jpg"
document.querySelector('a-assets').appendChild(img)
document.querySelector("a-assets > img[src='https://example.com/it's-a-photo.jpg'")
Uncaught SyntaxError: Failed to execute 'querySelector' on 'Document': 'a-assets > img[src='https://example.com/it's-a-photo.jpg'' is not a valid selector.
document.querySelector("a-assets > img[src='https://example.com/it\\'s-a-photo.jpg'")
<img src=​"https:​/​/​example.com/​it's-a-photo.jpg">​