From 737b1239949c888be0486edd17946454202a4950 Mon Sep 17 00:00:00 2001
From: Shawn <shawn@ourpad.casa>
Date: Fri, 12 Jun 2026 14:17:24 -0400
Subject: [PATCH] R2: Add escapeHtml to app.js for models/irs pages

---
 src/web/static/app.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/web/static/app.js b/src/web/static/app.js
index e206a73..06a2327 100644
--- a/src/web/static/app.js
+++ b/src/web/static/app.js
@@ -5,6 +5,15 @@
  * and provides REST helper functions used by all pages.
  */
 
+/* ── XSS-safe string helper ───────────────────────────────────────── */
+
+function escapeHtml(text) {
+    if (text == null) return '';
+    const div = document.createElement('div');
+    div.appendChild(document.createTextNode(String(text)));
+    return div.innerHTML;
+}
+
 /* ── REST helpers ───────────────────────────────────────────────── */
 
 async function apiGet(path) {