Chuck c80c23cd08 fix(security): Fix XSS vulnerability in handleCustomFeedLogoUpload ...

Replace innerHTML usage with safe DOM manipulation using createElement
and setAttribute to prevent XSS when injecting uploadedFile.path and
uploadedFile.id values.

- Clear logoCell using textContent instead of innerHTML
- Create all DOM elements using document.createElement
- Set uploadedFile.path and uploadedFile.id via setAttribute (automatically escaped)
- Properly structure DOM tree by appending elements in order
- Prevents malicious HTML/script injection through file path or ID values

2026-01-08 12:27:41 -05:00

..

v3

fix(security): Fix XSS vulnerability in handleCustomFeedLogoUpload

2026-01-08 12:27:41 -05:00