From 9180fbbfa9e4f7425b3606a8b6abb44513b26020 Mon Sep 17 00:00:00 2001 From: Brian Krabach Date: Wed, 15 Apr 2026 17:54:39 -0700 Subject: [PATCH] fix: remove escapeHtml() from textContent assignment on view label textContent is inherently XSS-safe and does not interpret HTML entities. Wrapping with escapeHtml() caused literal entity strings (e.g., &) to display instead of the intended characters (e.g., &) for view names containing special characters like &, <, or >. Generated with Amplifier Co-Authored-By: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com> --- muxplex/frontend/app.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/muxplex/frontend/app.js b/muxplex/frontend/app.js index 769c26c..1a092e9 100644 --- a/muxplex/frontend/app.js +++ b/muxplex/frontend/app.js @@ -859,7 +859,7 @@ function renderViewDropdown() { } else if (_activeView === 'hidden') { label.textContent = 'Hidden'; } else { - label.textContent = escapeHtml(_activeView); + label.textContent = _activeView; } } }