From 908ec73bd6f9366188d7f89b07199a79196d24e7 Mon Sep 17 00:00:00 2001
From: lgelauff <32471480+lgelauff@users.noreply.github.com>
Date: Mon, 5 Oct 2026 12:13:40 +0000
Subject: [PATCH] fix(frontend): render string dialog content as text, not HTML
dialogService rendered string `content` via innerHTML. RoundNew passes
the import warnings as a string, and those contain file names taken
from user-provided CSVs / Google Sheets / gists, so a name such as
`
` ran script in the importing coordinator's
session. Category imports were not affected (Commons titles cannot
contain < or >).
String content is now a text child. Display is otherwise unchanged:
the dialog body has no white-space rule, so the '\n' separators were
already collapsed under innerHTML. The only other string caller, the
round delete confirmation, is plain text.
Co-Authored-By: Claude Opus 5.5
---
frontend/src/services/dialogService.js | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/frontend/src/services/dialogService.js b/frontend/src/services/dialogService.js
index cfb75202..96247b28 100644
--- a/frontend/src/services/dialogService.js
+++ b/frontend/src/services/dialogService.js
@@ -51,8 +51,10 @@ const dialogService = () => {
},
{
default: () => {
+ // String content is rendered as text, never as HTML: callers pass
+ // messages that can contain user-provided file names (import warnings).
if (typeof dialogConfig.value.content === 'string') {
- return h('div', { innerHTML: dialogConfig.value.content })
+ return h('div', dialogConfig.value.content)
} else if (dialogConfig.value.content) {
return h(dialogConfig.value.content, {
...dialogConfig.value.props,