From 5b6bba294e7d6d733cc3dcd286433de4eb08343f Mon Sep 17 00:00:00 2001
From: Kieran Klukas <kieran@dunkirk.sh>
Date: Tue, 11 Aug 2026 18:36:04 -0400
Subject: [PATCH] fix: escape user agents and referers in the dashboard

---
 src/dashboard.html | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/dashboard.html b/src/dashboard.html
index d3fda8b..ed802ba 100644
--- a/src/dashboard.html
+++ b/src/dashboard.html
@@ -466,6 +466,12 @@
       return n.toLocaleString();
     }
 
+    function escapeHtml(value) {
+      return String(value ?? '').replace(/[&<>"']/g, c => (
+        { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
+      ));
+    }
+
     function formatMs(ms) {
       if (ms === null || ms === undefined) return '-';
       if (ms < 0.01) return '0ms';
@@ -844,7 +850,7 @@
         return `
           <div class="ua-item">
             <span class="ua-rank ${rankClass}">${i + 1}</span>
-            <span class="ua-name" title="${item.full}">${item.name}</span>
+            <span class="ua-name" title="${escapeHtml(item.full)}">${escapeHtml(item.name)}</span>
             <span class="ua-count">${formatNumber(item.hits)}</span>
           </div>
         `;
-- 
2.51.2