HTML-escape any page names that come from external queries

edwardspec · Dec 25, 2024 · ebf7d32 · ebf7d32
1 parent fda4c30
commit ebf7d32
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/modules/ext.askai.chatwith.js b/modules/ext.askai.chatwith.js
@@ -92,11 +92,11 @@ $( function () {
 					displayProgress( $( '<b>' ).append( mw.msg( 'askai-excluded-pages' ) ) );
 					displayProgress( allPageNames.filter( ( name ) =>
 						pageNames.indexOf( name ) === -1
-					).join( '<br>' ) );
+					).map( mw.html.escape ).join( '<br>' ) );
 				}
 
 				displayProgress( $( '<b>' ).append( mw.msg( 'askai-included-pages' ) ) );
-				displayProgress( pageNames.join( '<br>' ) );
+				displayProgress( pageNames.map( mw.html.escape ).join( '<br>' ) );
 
 				// Download each of the articles and find the paragraphs that have the snippet.
 				return Promise.all(