Inline handlers built as onclick="fn('${esc(id)}')" were injectable:
esc() turns ' into ', which the browser decodes back to ' before
the JS runs, so an id like x');alert(1);// broke out of the string.
Ids can come from a restored backup file or a synced catalog. Add
SunSafe.jsArg (JSON.stringify + HTML escape) and use it in all 24
handlers across app-runtime.js and index.html, including the new
banquet-menu ones. Verified locally: an id containing a JS payload
is passed through as a plain string and nothing executes.
Also replace the Settings version label that still showed
v17.6.0 · 2026.09.07 with the current release, and bump the script
cache-busting string so the fix reaches browsers.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
