second pass. medium

bincio/edit/server.py

@@ -265,11 +265,15 @@ async function uploadFiles(files) {
   }
 }
 
+function escapeHtml(s) {
+  return s.replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
+}
+
 function renderImageList() {
   const list = document.getElementById('image-list');
   list.innerHTML = uploadedImages.map(f =>
-    `<span class="image-chip">${f}
-      <button type="button" onclick="removeImage('${f}')" title="Remove">×</button>
+    `<span class="image-chip">${escapeHtml(f)}
+      <button type="button" onclick="removeImage('${escapeHtml(f)}')" title="Remove">×</button>
     </span>`
   ).join('');
 }
@@ -405,7 +409,7 @@ async def save_activity(activity_id: str, payload: dict[str, Any]) -> JSONRespon
     lines: list[str] = []
     if payload.get("title"):
         lines.append(f"title: {json.dumps(payload['title'])}")
-    if payload.get("sport") and payload["sport"] != "other":
+    if payload.get("sport") and payload["sport"] in SPORTS and payload["sport"] != "other":
         lines.append(f"sport: {payload['sport']}")
     if payload.get("gear"):
         lines.append(f"gear: {json.dumps(payload['gear'])}")
@@ -443,7 +447,12 @@ async def upload_image(activity_id: str, file: UploadFile = File(...)) -> JSONRe
 
     images_dir = dd / "edits" / "images" / activity_id
     images_dir.mkdir(parents=True, exist_ok=True)
-    dest = images_dir / Path(file.filename).name
+    safe_name = Path(file.filename).name
+    # Only allow image content types
+    ct = file.content_type or ""
+    if not ct.startswith("image/"):
+        raise HTTPException(400, f"Only image files are accepted (got {ct})")
+    dest = images_dir / safe_name
     dest.write_bytes(await file.read())
     return JSONResponse({"ok": True, "filename": dest.name})