Jake Marsh fc446d6c6a productivity: escape file-derived content before innerHTML rendering in dashboard ...

Task titles, notes, subtask text, and section names from the opened task
file, plus memory file and directory names, were interpolated into
innerHTML template strings unescaped, so markup in that content was parsed
as HTML when the dashboard rendered.

- Route every such interpolation through the existing escapeHtml() helper.
- Make escapeHtml() also escape quotes so it is safe inside attribute
  values (data-tab, data-search, placeholder).
- Replace the inline onclick/oninput handlers that embedded file and
  directory names in JavaScript string literals with addEventListener,
  matching the pattern the rest of the file already uses.
- Bump plugin version to 1.3.1.

2026-08-06 22:36:08 +00:00

286 B

Raw Permalink Blame History

View Raw