From 2613c3eb226f5ebdd5b4018966a6ee0e2505b650 Mon Sep 17 00:00:00 2001
From: awsr <43862868+awsr@users.noreply.github.com>
Date: Sun, 9 Nov 2025 15:19:11 -0800
Subject: [PATCH] Ensure lora tags don't break HTML

Plus & for formatting safety
---
 javascript/logMonitor.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/javascript/logMonitor.js b/javascript/logMonitor.js
index 3af5a67a6..2ff2e3228 100644
--- a/javascript/logMonitor.js
+++ b/javascript/logMonitor.js
@@ -17,6 +17,10 @@ function dateToStr(ts) {
   return s;
 }
 
+function htmlEscape(text) {
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;")
+}
+
 async function logMonitor() {
   const addLogLine = (line) => {
     try {
@@ -27,7 +31,7 @@ async function logMonitor() {
       if (l.level === 'WARNING') logWarnings++;
       if (l.level === 'ERROR') logErrors++;
       const module = `<td style="color: var(--var(--neutral-400))">${l.module}</td>`;
-      row.innerHTML = `<td>${dateToStr(l.created)}</td>${level}<td>${l.facility}</td>${module}<td>${l.msg}</td>`;
+      row.innerHTML = `<td>${dateToStr(l.created)}</td>${level}<td>${l.facility}</td>${module}<td>${htmlEscape(l.msg)}</td>`;
       logMonitorEl.appendChild(row);
     } catch (e) {
       error(`logMonitor: ${e}\n${line}`);