From 38e1a175b6d997d05bdc392db2600583456f9eb2 Mon Sep 17 00:00:00 2001
From: Felix Martin <mail@felixm.de>
Date: Mon, 1 Jun 2026 20:29:42 -0400
Subject: [PATCH] Harden settings UI: robust parentDir, escape browse paths,
 surface load error

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 internal/web/static/app.js | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/internal/web/static/app.js b/internal/web/static/app.js
index 0bf15d9..d862a5b 100644
--- a/internal/web/static/app.js
+++ b/internal/web/static/app.js
@@ -346,6 +346,12 @@ function openSettings() {
     document.getElementById('setSave').onclick = saveSettings;
     document.getElementById('setBrowse').onclick = () =>
       loadBrowse(parentDir(document.getElementById('setKnow').value));
+  }).catch(() => {
+    const ov = document.getElementById('settingsOverlay');
+    ov.innerHTML = '<div class="modal"><div class="set-error">Could not load settings.</div>' +
+      '<div class="modal-actions"><button type="button" class="btn btn-ghost" id="setClose">Close</button></div></div>';
+    ov.hidden = false;
+    document.getElementById('setClose').onclick = closeSettings;
   });
 }
 
@@ -371,7 +377,13 @@ function saveSettings() {
 
 function parentDir(path) {
   if (!path) return '';
-  return path.replace(/\/[^/]*$/, '');
+  const i = path.lastIndexOf('/');
+  if (i <= 0) return '/';
+  return path.slice(0, i);
+}
+
+function esc(s) {
+  return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/"/g, '&quot;');
 }
 
 function loadBrowse(dir) {
@@ -383,16 +395,16 @@ function loadBrowse(dir) {
   }).then(d => {
     const items = [];
     if (d.parent && d.parent !== d.dir) {
-      items.push(`<li><button type="button" data-dir="${d.parent}">../</button></li>`);
+      items.push(`<li><button type="button" data-dir="${esc(d.parent)}">../</button></li>`);
     }
     for (const e of d.entries) {
       if (e.is_dir) {
-        items.push(`<li><button type="button" data-dir="${e.path}">${e.name}/</button></li>`);
+        items.push(`<li><button type="button" data-dir="${esc(e.path)}">${esc(e.name)}/</button></li>`);
       } else {
-        items.push(`<li><button type="button" data-file="${e.path}">${e.name}</button></li>`);
+        items.push(`<li><button type="button" data-file="${esc(e.path)}">${esc(e.name)}</button></li>`);
       }
     }
-    pane.innerHTML = `<div class="browse-dir">${d.dir}</div><ul class="browse-list">${items.join('')}</ul>`;
+    pane.innerHTML = `<div class="browse-dir">${esc(d.dir)}</div><ul class="browse-list">${items.join('')}</ul>`;
     pane.querySelectorAll('button[data-dir]').forEach(b =>
       b.onclick = () => loadBrowse(b.getAttribute('data-dir')));
     pane.querySelectorAll('button[data-file]').forEach(b =>