security(ui): escape untrusted node, observer and route values in HTML rendering #333

Context

Identified by a static comparison on 2026-10-07 against dborup/CoreScope master 6444294d938083f6d935d0445c27bc6a7bbf360e. This is follow-up work for evaluation and implementation, not a claim of an observed production incident. Recheck current master before implementation. No deployment is authorized by this issue alone.

Upstream reference: Kpa-clawbot fork, PR 2118 (reference only; intentionally not linked to avoid upstream notifications)

Also covers Kpa-clawbot fork, PR 2124 (reference only; intentionally not linked to avoid upstream notifications); keep these in one issue.

Benefit and existing coverage

Prevent mesh/MQTT-supplied strings and route text from being interpreted as markup. Current master still interpolates unescaped values in favorites, geo-filter prune previews, observer regions, packet region badges, clock-skew observer names, RF-health attributes and the unknown-route heading. Our #193 / #194 fixed an analytics tab selector, not these rendering sites.

Required work

• Audit the upstream sinks in public/app.js, analytics.js, customize-v2.js, live.js, nodes.js, observers.js and packets.js, including adjacent sinks in our fork.
• Use textContent where possible and context-appropriate escaping for HTML text and attributes. Do not confuse HTML escaping with URL encoding or CSS selector escaping.
• Preserve navigation, observer selection, favorites and normal Unicode names.
• Add hostile-string regression tests for text and attributes, plus browser-level tests for representative rendering paths. Do not send test payloads to production.

Acceptance criteria

• Listed and adjacent rendering sites safely display untrusted values as text.
• Tests cover quotes, angle brackets, ampersands and normal names.
• Unknown routes remain readable without interpreting markup.

Suggested priority: high. Static sink review is not a demonstrated end-to-end exploit.