fix: escape single quotes in U.esc to prevent onclick attribute injection

2026-07-12 13:09:10 +08:00
parent ea7a3c42be
commit da5aa09421
1 changed files with 1 additions and 1 deletions
--- a/public/js/utils.js
+++ b/public/js/utils.js
@@ -22,7 +22,7 @@ const U = {

  esc(s) {
    if (!s) return '';
-    return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;');
+    return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
  },

  showAlert(containerId, type, msg) {