refactor(settings-window.ts): dom xss vulnerability due to unescaped html in template literal

[tang-vu]

✨ Code Quality

Problem

User-controlled data from localStorage (key and panel.name) is interpolated directly into an HTML string and assigned via innerHTML without sanitization. This creates a DOM-based Cross-Site Scripting (XSS) vulnerability. The escapeHtml utility is explicitly imported at the top of the file but mistakenly left unused.

Severity: high
File: src/settings-window.ts

Solution

Wrap the interpolated variables with the imported escapeHtml function:

Changes

• src/settings-window.ts (modified)

Summary

Type of change

• Bug fix
• New feature
• New data source / feed
• New map layer
• Refactor / code cleanup
• Documentation
• CI / Build / Infrastructure

Affected areas

• Map / Globe
• News panels / RSS feeds
• AI Insights / World Brief
• Market Radar / Crypto
• Desktop app (Tauri)
• API endpoints (/api/*)
• Config / Settings
• Other:

Checklist

• Tested on worldmonitor.app variant
• Tested on tech.worldmonitor.app variant (if applicable)
• New RSS feed domains added to api/rss-proxy.js allowlist (if adding feeds)
• No API keys or secrets committed
• TypeScript compiles without errors (npm run typecheck)

Screenshots

---

🤖 About this PR

This pull request was generated by ContribAI, an AI agent
that helps improve open source projects. The change was:

1. Discovered by automated code analysis
2. Generated by AI with context-aware code generation
3. Self-reviewed by AI quality checks

If you have questions or feedback about this PR, please comment below.
We appreciate your time reviewing this contribution!

Closes #2022

[vercel]

@tang-vu is attempting to deploy a commit to the Elie Team on Vercel.

A member of the Team first needs to authorize it.

[jrtorrez31337]

Reviewed the diff. The fix is correct and complete.

The two lines changed are the only unescaped interpolations in the file that take user-sourced data. Lines 80-81 already use escapeHtml, and the boolean-driven class/checkbox values are constants, not user input. document.title on line 28 uses a text property, not innerHTML, so it's not a vector.

The attack path is narrow (requires prior localStorage poisoning) but this is a valid defense-in-depth fix consistent with the project's coding standard of escaping all output.

[tang-vu]

Reviewed the diff. The fix is correct and complete.

The two lines changed are the only unescaped interpolations in the file that take user-sourced data. Lines 80-81 already use escapeHtml, and the boolean-driven class/checkbox values are constants, not user input. document.title on line 28 uses a text property, not innerHTML, so it's not a vector.

The attack path is narrow (requires prior localStorage poisoning) but this is a valid defense-in-depth fix consistent with the project's coding standard of escaping all output.

Thanks for the review! Could a maintainer authorize the Vercel deployment so this can be merged?