We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
2 parents bd7209a + a424744 commit cdb056eCopy full SHA for cdb056e
1 file changed
website/src/scripts/utils.ts
@@ -298,7 +298,8 @@ export function setupDropdownCloseHandlers(): void {
298
export function getActionButtonsHtml(filePath: string, small = false): string {
299
const btnClass = small ? 'btn-small' : '';
300
const iconSize = small ? 14 : 16;
301
- const escapedPath = filePath.replace(/'/g, "\\'");
+ // Escape backslashes first, then single quotes to prevent breaking out of the JavaScript string literal in the onclick attribute
302
+ const escapedPath = filePath.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
303
304
return `
305
<button class="btn btn-secondary ${btnClass} action-download" data-path="${escapeHtml(filePath)}" onclick="event.stopPropagation(); window.__downloadFile && window.__downloadFile('${escapedPath}')" title="Download file">
0 commit comments