@@ -97,6 +97,12 @@ class UIManager {
9797 if ( element ) element . innerHTML = html ;
9898 }
9999
100+ escapeHtml ( text ) {
101+ const div = document . createElement ( 'div' ) ;
102+ div . textContent = text ;
103+ return div . innerHTML ;
104+ }
105+
100106 addClass ( element , className ) {
101107 if ( element ) element . classList . add ( className ) ;
102108 }
@@ -170,7 +176,7 @@ class UIManager {
170176 const fileInfo = this . getElement ( CONSTANTS . ELEMENTS . FILE_INFO ) ;
171177 if ( file && fileInfo ) {
172178 const size = ( file . size / 1024 / 1024 ) . toFixed ( 2 ) ;
173- this . setElementHTML ( fileInfo , `Selected file: ${ file . name } (${ size } MB)` ) ;
179+ this . setElementHTML ( fileInfo , `Selected file: ${ this . escapeHtml ( file . name ) } (${ size } MB)` ) ;
174180 this . showElement ( fileInfo ) ;
175181 }
176182 }
@@ -376,7 +382,7 @@ class ResultDisplayManager {
376382 // Header
377383 if ( displayData . length > 0 ) {
378384 Object . keys ( displayData [ 0 ] ) . forEach ( key => {
379- html += `<th>${ key } </th>` ;
385+ html += `<th>${ this . uiManager . escapeHtml ( key ) } </th>` ;
380386 } ) ;
381387 html += '</tr></thead>' ;
382388 }
@@ -386,7 +392,7 @@ class ResultDisplayManager {
386392 displayData . forEach ( row => {
387393 html += '<tr>' ;
388394 Object . values ( row ) . forEach ( value => {
389- html += `<td>${ value } </td>` ;
395+ html += `<td>${ this . uiManager . escapeHtml ( String ( value ) ) } </td>` ;
390396 } ) ;
391397 html += '</tr>' ;
392398 } ) ;
0 commit comments