From dc02c63058b15927c113dc70e16d0095850e1134 Mon Sep 17 00:00:00 2001
From: Alex Sorafumo <alex@yuion.net>
Date: Wed, 30 Sep 2026 11:02:13 +1000
Subject: [PATCH 01/10] fix(ui): escape user names in confirm modal and editor
 HTML

Confirm modal content is rendered with innerHTML, so resource names
from the API could inject markup. Add an escapeHtml helper and use it
where callers build HTML strings. Escape uploaded file names before
SunEditor insertHTML, and destroy the editor on re-init and destroy.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 src/app/admin/build-list.component.ts         |  5 +++--
 src/app/admin/edge.component.ts               |  4 ++--
 src/app/admin/extensions.component.ts         |  3 ++-
 src/app/admin/resource-imports.component.ts   |  3 ++-
 .../admin/signage-ai/signage-ai.component.ts  |  5 +++--
 src/app/admin/staff-api.component.ts          |  3 ++-
 src/app/admin/storage/storage.component.ts    |  5 +++--
 src/app/admin/upload-library.component.ts     |  3 ++-
 src/app/common/general.ts                     | 17 ++++++++++++++
 src/app/common/item.service.ts                |  5 +++--
 src/app/domains/domain-state.service.ts       |  3 ++-
 src/app/groups/group-state.service.ts         |  5 +++--
 src/app/systems/system-state.service.ts       |  6 ++---
 src/app/triggers/trigger-state.service.ts     |  3 ++-
 .../rich-text-input.component.ts              | 22 +++++++++++++------
 src/app/ui/metadata-display.component.ts      |  3 ++-
 src/app/users/users-state.service.ts          |  7 ++++--
 src/app/zones/zones-state.service.ts          |  6 ++---
 src/tests/common/general.spec.ts              | 14 ++++++++++++
 src/tests/users/user-lifecycle.spec.ts        |  5 ++++-
 20 files changed, 92 insertions(+), 35 deletions(-)

diff --git a/src/app/admin/build-list.component.ts b/src/app/admin/build-list.component.ts
index da1942124..0d311b8cb 100644
--- a/src/app/admin/build-list.component.ts
+++ b/src/app/admin/build-list.component.ts
@@ -5,6 +5,7 @@ import { MatProgressBarModule } from '@angular/material/progress-bar';
 import { MatTooltipModule } from '@angular/material/tooltip';
 import { del, get } from '@placeos/ts-client';
 import { toQueryString } from '../common/api';
+import { escapeHtml } from '../common/general';
 import { i18n } from '../common/locale.service';
 import { notifyError, notifySuccess } from '../common/notifications';
 import { openConfirmModal } from '../overlays/confirm-modal.component';
@@ -159,8 +160,8 @@ export class PlaceBuildListComponent implements OnInit {
             {
                 title: i18n('ADMIN.BUILD_LIST_REMOVE'),
                 content: i18n('ADMIN.BUILD_LIST_REMOVE_MSG', {
-                    driver: i.driver,
-                    repo: i.repo,
+                    driver: escapeHtml(i.driver),
+                    repo: escapeHtml(i.repo),
                 }),
                 icon: { type: 'icon', content: 'delete' },
             },
diff --git a/src/app/admin/edge.component.ts b/src/app/admin/edge.component.ts
index 404b1f78a..f0dabe5ae 100644
--- a/src/app/admin/edge.component.ts
+++ b/src/app/admin/edge.component.ts
@@ -11,7 +11,7 @@ import {
     removeEdge,
     retrieveEdgeToken,
 } from '@placeos/ts-client';
-import { copyToClipboard } from '../common/general';
+import { copyToClipboard, escapeHtml } from '../common/general';
 import {
     notifyError,
     notifyInfo,
@@ -228,7 +228,7 @@ export class PlaceEdgeComponent implements OnInit {
         const details = await openConfirmModal(
             {
                 title: 'Remove edge?',
-                content: `Remove <strong>${i.name}</strong>?<br>You or your users may lose access to some data.`,
+                content: `Remove <strong>${escapeHtml(i.name)}</strong>?<br>You or your users may lose access to some data.`,
                 icon: { type: 'icon', content: 'delete' },
             },
             this._dialog,
diff --git a/src/app/admin/extensions.component.ts b/src/app/admin/extensions.component.ts
index e4868ef7f..916737364 100644
--- a/src/app/admin/extensions.component.ts
+++ b/src/app/admin/extensions.component.ts
@@ -7,6 +7,7 @@ import { MatProgressBarModule } from '@angular/material/progress-bar';
 import { MatSelectModule } from '@angular/material/select';
 import { MatTooltipModule } from '@angular/material/tooltip';
 import { PlaceDomain, updateDomain } from '@placeos/ts-client';
+import { escapeHtml } from '../common/general';
 import { notifyError } from '../common/notifications';
 import { waitForEvent } from '../common/signals';
 import { ApplicationIcon, DialogEvent } from '../common/types';
@@ -256,7 +257,7 @@ export class PlaceExtensionsComponent implements OnInit {
             {
                 data: {
                     title: 'Remove extension',
-                    content: `Are you sure you want to remove the extension "${item.name}" from ${item.type}?`,
+                    content: `Are you sure you want to remove the extension "${escapeHtml(item.name)}" from ${escapeHtml(item.type)}?`,
                     icon: { content: 'delete' },
                 },
             },
diff --git a/src/app/admin/resource-imports.component.ts b/src/app/admin/resource-imports.component.ts
index 45f7a8010..2c13cff86 100644
--- a/src/app/admin/resource-imports.component.ts
+++ b/src/app/admin/resource-imports.component.ts
@@ -8,6 +8,7 @@ import { MatSelectModule } from '@angular/material/select';
 import { MatTooltipModule } from '@angular/material/tooltip';
 import { RouterModule } from '@angular/router';
 import { addSystem, query, querySystemsWithEmails } from '@placeos/ts-client';
+import { escapeHtml } from '../common/general';
 import { i18n } from '../common/locale.service';
 import { notifySuccess, notifyWarn } from '../common/notifications';
 import { openConfirmModal } from '../overlays/confirm-modal.component';
@@ -215,7 +216,7 @@ export class ResourceImportsComponent implements OnInit {
                     count: missing.length,
                 })}</p>
                 <ul class="list-disc ml-4 text-left px-8 text-sm">${missing
-                    .map((_) => `<li>${_.display_name}</li>`)
+                    .map((_) => `<li>${escapeHtml(_.display_name)}</li>`)
                     .join('')}</ul>
                 `,
                 icon: { type: 'icon', content: 'publish' },
diff --git a/src/app/admin/signage-ai/signage-ai.component.ts b/src/app/admin/signage-ai/signage-ai.component.ts
index 17e67f6bf..2669df37e 100644
--- a/src/app/admin/signage-ai/signage-ai.component.ts
+++ b/src/app/admin/signage-ai/signage-ai.component.ts
@@ -3,6 +3,7 @@ import { MatRippleModule } from '@angular/material/core';
 import { MatDialog } from '@angular/material/dialog';
 import { MatProgressBarModule } from '@angular/material/progress-bar';
 import { MatTooltipModule } from '@angular/material/tooltip';
+import { escapeHtml } from '../../common/general';
 import { i18n } from '../../common/locale.service';
 import { notifyError, notifySuccess } from '../../common/notifications';
 import { openConfirmModal } from '../../overlays/confirm-modal.component';
@@ -284,7 +285,7 @@ export class SignageAIComponent implements OnInit {
             {
                 title: i18n('ADMIN.AI_PROVIDER_TEST_TITLE'),
                 content: i18n('ADMIN.AI_PROVIDER_TEST_MSG', {
-                    name: item.name,
+                    name: escapeHtml(item.name),
                 }),
                 icon: { content: 'bolt' },
             },
@@ -314,7 +315,7 @@ export class SignageAIComponent implements OnInit {
             {
                 title: i18n('ADMIN.AI_PROVIDER_REMOVE_TITLE'),
                 content: i18n('ADMIN.AI_PROVIDER_REMOVE_MSG', {
-                    name: item.name,
+                    name: escapeHtml(item.name),
                 }),
                 icon: { content: 'delete_forever' },
             },
diff --git a/src/app/admin/staff-api.component.ts b/src/app/admin/staff-api.component.ts
index 544275828..ea96c8952 100644
--- a/src/app/admin/staff-api.component.ts
+++ b/src/app/admin/staff-api.component.ts
@@ -9,6 +9,7 @@ import { MatSelectModule } from '@angular/material/select';
 import { MatTooltipModule } from '@angular/material/tooltip';
 import { del, get, PlaceDomain } from '@placeos/ts-client';
 import { addDays, getUnixTime, startOfDay } from 'date-fns';
+import { escapeHtml } from '../common/general';
 import { notifyError, notifySuccess } from '../common/notifications';
 import { HashMap } from '../common/types';
 import { openConfirmModal } from '../overlays/confirm-modal.component';
@@ -247,7 +248,7 @@ export class PlaceStaffAPIComponent implements OnInit {
         const details = await openConfirmModal(
             {
                 title: 'Remove tenant?',
-                content: `Remove <strong>${tenant.name}</strong> from this domain?<br>
+                content: `Remove <strong>${escapeHtml(tenant.name)}</strong> from this domain?<br>
                 <p style="text-align: left; width: 100%;">This will remove all related:</p><br>
                 <ul style="list-style: disc;text-align: left;padding-left: 2rem">
                 <li>bookings (such as desk bookings)</li>
diff --git a/src/app/admin/storage/storage.component.ts b/src/app/admin/storage/storage.component.ts
index 19efc24ec..3ddcdb22f 100644
--- a/src/app/admin/storage/storage.component.ts
+++ b/src/app/admin/storage/storage.component.ts
@@ -6,6 +6,7 @@ import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatProgressBarModule } from '@angular/material/progress-bar';
 import { MatSelectModule } from '@angular/material/select';
 import { MatTooltipModule } from '@angular/material/tooltip';
+import { escapeHtml } from '../../common/general';
 import { i18n } from '../../common/locale.service';
 import { openConfirmModal } from '../../overlays/confirm-modal.component';
 import { IconComponent } from '../../ui/icon.component';
@@ -220,8 +221,8 @@ export class StorageComponent implements OnInit {
             {
                 title: i18n('ADMIN.STORAGE_REMOVE_TITLE'),
                 content: i18n('ADMIN.STORAGE_REMOVE_MSG', {
-                    type: item.storage_type,
-                    name: item.bucket_name,
+                    type: escapeHtml(item.storage_type),
+                    name: escapeHtml(item.bucket_name),
                 }),
                 icon: { content: 'delete_forever' },
             },
diff --git a/src/app/admin/upload-library.component.ts b/src/app/admin/upload-library.component.ts
index 43f6984fe..36cf4bc4a 100644
--- a/src/app/admin/upload-library.component.ts
+++ b/src/app/admin/upload-library.component.ts
@@ -19,6 +19,7 @@ import { MatSelectModule } from '@angular/material/select';
 import { MatTooltipModule } from '@angular/material/tooltip';
 import { apiKey, cleanObject, query, remove, token } from '@placeos/ts-client';
 import { AsyncHandler } from '../common/async-handler.class';
+import { escapeHtml } from '../common/general';
 import { i18n } from '../common/locale.service';
 import {
     notifyError,
@@ -531,7 +532,7 @@ export class UploadLibraryComponent extends AsyncHandler implements OnInit {
             {
                 title: i18n('ADMIN.UPLOADS_LIB_REMOVE'),
                 content: i18n('ADMIN.UPLOADS_LIB_REMOVE_MSG', {
-                    filename: upload.file_name,
+                    filename: escapeHtml(upload.file_name),
                 }),
                 icon: { type: 'icon', content: 'delete' },
             },
diff --git a/src/app/common/general.ts b/src/app/common/general.ts
index dba803ee7..da6330d6a 100644
--- a/src/app/common/general.ts
+++ b/src/app/common/general.ts
@@ -105,6 +105,23 @@ export function unique<T = string>(array: T[], key = '') {
     );
 }
 
+const HTML_ENTITIES: Record<string, string> = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+};
+
+/**
+ * Escape a value for use in an HTML string, e.g. a user controlled name
+ * inside confirm modal content or editor HTML
+ * @param value Value to escape
+ */
+export function escapeHtml(value: unknown): string {
+    return `${value ?? ''}`.replace(/[&<>"']/g, (char) => HTML_ENTITIES[char]);
+}
+
 /**
  * Generate a random number
  * @param ceil Biggest value to generate not inclusive
diff --git a/src/app/common/item.service.ts b/src/app/common/item.service.ts
index 2f76f70c3..f03b0c24c 100644
--- a/src/app/common/item.service.ts
+++ b/src/app/common/item.service.ts
@@ -34,7 +34,7 @@ import {
     CascadeResource,
     runCascade,
 } from './cascade-delete';
-import { log } from './general';
+import { escapeHtml, log } from './general';
 import { i18n } from './locale.service';
 import { notifyError, notifySuccess } from './notifications';
 import { waitForEvent, waitForSignalValue } from './signals';
@@ -342,12 +342,13 @@ export class ActiveItemService extends AsyncHandler {
                             ? 'USERS.FORCE_DELETE_MSG'
                             : `${actions.name}.DELETE_MSG`,
                         {
-                            name:
+                            name: escapeHtml(
                                 (
                                     item as PlaceResource & {
                                         display_name?: string;
                                     }
                                 ).display_name || item.name,
+                            ),
                         },
                     ),
                     extra: actions.delete_extra
diff --git a/src/app/domains/domain-state.service.ts b/src/app/domains/domain-state.service.ts
index 6da59ddbf..9ab0eebd6 100644
--- a/src/app/domains/domain-state.service.ts
+++ b/src/app/domains/domain-state.service.ts
@@ -31,6 +31,7 @@ import {
     updateDomain,
 } from '@placeos/ts-client';
 import { filter, map } from 'rxjs';
+import { escapeHtml } from '../common/general';
 import { ActiveItemService } from '../common/item.service';
 import { i18n } from '../common/locale.service';
 import { notifyError, notifySuccess } from '../common/notifications';
@@ -258,7 +259,7 @@ export class DomainStateService {
         const details = await openConfirmModal(
             {
                 title: `Delete application`,
-                content: `<p>Are you sure you want delete the application ${item.name}?</p><p>Configuration will be <strong>immediately</strong> updated</p>`,
+                content: `<p>Are you sure you want delete the application ${escapeHtml(item.name)}?</p><p>Configuration will be <strong>immediately</strong> updated</p>`,
                 icon: { type: 'icon', content: 'delete' },
             },
             this._dialog,
diff --git a/src/app/groups/group-state.service.ts b/src/app/groups/group-state.service.ts
index 4d56f49fc..6b28ca0e5 100644
--- a/src/app/groups/group-state.service.ts
+++ b/src/app/groups/group-state.service.ts
@@ -17,6 +17,7 @@ import {
     updateGroupUser,
     updateGroupZone,
 } from '@placeos/ts-client';
+import { escapeHtml } from '../common/general';
 import { ActiveItemService } from '../common/item.service';
 import { i18n } from '../common/locale.service';
 import { notifyError, notifySuccess } from '../common/notifications';
@@ -250,7 +251,7 @@ export class GroupStateService {
             {
                 title: i18n('GROUPS.USER_REMOVE'),
                 content: i18n('GROUPS.USER_REMOVE_MSG', {
-                    name: item.user?.name || item.user_id,
+                    name: escapeHtml(item.user?.name || item.user_id),
                 }),
                 icon: { type: 'icon', content: 'delete' },
             },
@@ -312,7 +313,7 @@ export class GroupStateService {
             {
                 title: i18n('GROUPS.ZONE_REMOVE'),
                 content: i18n('GROUPS.ZONE_REMOVE_MSG', {
-                    name: item.zone?.name || item.zone_id,
+                    name: escapeHtml(item.zone?.name || item.zone_id),
                 }),
                 icon: { type: 'icon', content: 'delete' },
             },
diff --git a/src/app/systems/system-state.service.ts b/src/app/systems/system-state.service.ts
index 441156b57..e61720c39 100644
--- a/src/app/systems/system-state.service.ts
+++ b/src/app/systems/system-state.service.ts
@@ -31,7 +31,7 @@ import {
 import { calculateModuleIndex } from '../common/api';
 import { AsyncHandler } from '../common/async-handler.class';
 import { PlaceDebugService } from '../common/debug.service';
-import { unique } from '../common/general';
+import { escapeHtml, unique } from '../common/general';
 import {
     isSubsystemUser,
     querySupportSystems as querySystems,
@@ -488,7 +488,7 @@ export class SystemStateService extends AsyncHandler {
     public async removeTrigger(trigger: PlaceTrigger) {
         const details = await this.confirm({
             title: `Remove trigger`,
-            content: `<p>Are you sure you want remove trigger "${trigger.name}"?</p><p>Configuration will be updated <strong>immediately</strong>.</p>`,
+            content: `<p>Are you sure you want remove trigger "${escapeHtml(trigger.name)}"?</p><p>Configuration will be updated <strong>immediately</strong>.</p>`,
             icon: { type: 'icon', content: 'delete' },
         });
         if (details.reason !== 'done') return;
@@ -714,7 +714,7 @@ export class SystemStateService extends AsyncHandler {
     public async removeZone(zone: PlaceZone) {
         const details = await this.confirm({
             title: 'Remove zone?',
-            content: `<p>Are you sure you want remove zone "${zone.name}" from the system?</p>Configuration will be updated immediately.`,
+            content: `<p>Are you sure you want remove zone "${escapeHtml(zone.name)}" from the system?</p>Configuration will be updated immediately.`,
             icon: { type: 'icon', content: 'delete' },
         });
         if (details.reason !== 'done') return;
diff --git a/src/app/triggers/trigger-state.service.ts b/src/app/triggers/trigger-state.service.ts
index a9935a51a..d60a93336 100644
--- a/src/app/triggers/trigger-state.service.ts
+++ b/src/app/triggers/trigger-state.service.ts
@@ -13,6 +13,7 @@ import {
     updateTrigger,
 } from '@placeos/ts-client';
 
+import { escapeHtml } from '../common/general';
 import { ActiveItemService } from '../common/item.service';
 import { i18n } from '../common/locale.service';
 import { notifyError, notifySuccess } from '../common/notifications';
@@ -285,7 +286,7 @@ export class TriggerStateService {
                 title: i18n('TRIGGERS.REMOVE_INSTANCE_TITLE', { type }),
                 content: i18n('TRIGGERS.REMOVE_INSTANCE_MSG', {
                     type,
-                    name: instance.name,
+                    name: escapeHtml(instance.name),
                 }),
                 icon: { type: 'icon', content: 'delete' },
             },
diff --git a/src/app/ui/custom-fields/rich-text-input.component.ts b/src/app/ui/custom-fields/rich-text-input.component.ts
index 552b8d117..021a6ed3c 100644
--- a/src/app/ui/custom-fields/rich-text-input.component.ts
+++ b/src/app/ui/custom-fields/rich-text-input.component.ts
@@ -15,6 +15,7 @@ import { apiKey, token } from '@placeos/ts-client';
 import SunEditor from 'suneditor';
 import { font, fontSize, formatBlock, link, list } from 'suneditor/src/plugins';
 import { AsyncHandler } from '../../common/async-handler.class';
+import { escapeHtml } from '../../common/general';
 import { uploadFile } from '../../common/uploads';
 
 @Component({
@@ -77,6 +78,12 @@ export class RichTextInputComponent
         this.timeout('init', () => this._initialiseEditor());
     }
 
+    public override ngOnDestroy() {
+        this._editor?.destroy();
+        delete this._editor;
+        super.ngOnDestroy();
+    }
+
     /**
      * Update the form field value
      * @param new_value New value to set on the form field
@@ -97,7 +104,7 @@ export class RichTextInputComponent
             if (this._editor) {
                 this._setAuth();
                 setTimeout(() => {
-                    this._editor.setContents(value);
+                    this._editor?.setContents(value);
                 }, 100);
             } else this.timeout('write', () => this.writeValue(value));
         });
@@ -122,6 +129,7 @@ export class RichTextInputComponent
         }
         if (this._editor) {
             this.unsub('changes');
+            this._editor.destroy();
             _editor_el.innerHTML = '';
             delete this._editor;
         }
@@ -193,8 +201,8 @@ export class RichTextInputComponent
                 const link = `/api/engine/v2/uploads/${encodeURIComponent(upload.id)}/url`;
                 this._setAuth();
                 setTimeout(() => {
-                    this._editor.insertHTML(
-                        `<img src="${link}" alt="${file.name}" />`,
+                    this._editor?.insertHTML(
+                        `<img src="${link}" alt="${escapeHtml(file.name)}" />`,
                     );
                 }, 100);
             });
@@ -217,12 +225,12 @@ export class RichTextInputComponent
                 this._setAuth();
                 setTimeout(() => {
                     if (is_image) {
-                        this._editor.insertHTML(
-                            `<img src="${link}" alt="${file.name}" />`,
+                        this._editor?.insertHTML(
+                            `<img src="${link}" alt="${escapeHtml(file.name)}" />`,
                         );
                     } else {
-                        this._editor.insertHTML(
-                            `<a href="${link}" target="_blank">${file.name}</a>`,
+                        this._editor?.insertHTML(
+                            `<a href="${link}" target="_blank">${escapeHtml(file.name)}</a>`,
                         );
                     }
                 }, 100);
diff --git a/src/app/ui/metadata-display.component.ts b/src/app/ui/metadata-display.component.ts
index 78d603353..1913c3432 100644
--- a/src/app/ui/metadata-display.component.ts
+++ b/src/app/ui/metadata-display.component.ts
@@ -22,6 +22,7 @@ import {
     updateMetadata,
 } from '@placeos/ts-client';
 import { VERSION } from '../../env/version';
+import { escapeHtml } from '../common/general';
 // import { SchemaStateService } from '../admin/schema-state.service';
 import { AsyncHandler } from '../common/async-handler.class';
 import { notifyError, notifySuccess } from '../common/notifications';
@@ -322,7 +323,7 @@ export class MetadataDisplayComponent
             {
                 title: `Remove Metadata block`,
                 content: `
-                <p>Are you sure you want delete the metadata property "${field}"?</p>
+                <p>Are you sure you want delete the metadata property "${escapeHtml(field)}"?</p>
             `,
                 icon: { type: 'icon', content: 'delete' },
             },
diff --git a/src/app/users/users-state.service.ts b/src/app/users/users-state.service.ts
index 2fbbe3ec7..6456cc622 100644
--- a/src/app/users/users-state.service.ts
+++ b/src/app/users/users-state.service.ts
@@ -12,6 +12,7 @@ import {
     reviveUser,
     updateGroupUser,
 } from '@placeos/ts-client';
+import { escapeHtml } from '../common/general';
 import { ActiveItemService } from '../common/item.service';
 import { i18n } from '../common/locale.service';
 import { notifyError, notifySuccess } from '../common/notifications';
@@ -178,7 +179,7 @@ export class UsersStateService {
             {
                 title: i18n('USERS.GROUP_REMOVE'),
                 content: i18n('USERS.GROUP_REMOVE_MSG', {
-                    name: item.group?.name || item.group_id,
+                    name: escapeHtml(item.group?.name || item.group_id),
                 }),
                 icon: { type: 'icon', content: 'delete' },
             },
@@ -229,7 +230,9 @@ export class UsersStateService {
         const details = await openConfirmModal(
             {
                 title: i18n('USERS.REVIVE'),
-                content: i18n('USERS.REVIVE_MSG', { name: item.name }),
+                content: i18n('USERS.REVIVE_MSG', {
+                    name: escapeHtml(item.name),
+                }),
                 confirm_text: i18n('USERS.REVIVE'),
                 icon: { type: 'icon', content: 'restore_from_trash' },
             },
diff --git a/src/app/zones/zones-state.service.ts b/src/app/zones/zones-state.service.ts
index 7adf5f9d5..bd9bc31eb 100644
--- a/src/app/zones/zones-state.service.ts
+++ b/src/app/zones/zones-state.service.ts
@@ -18,7 +18,7 @@ import {
     updateGroupZone,
     updateZone,
 } from '@placeos/ts-client';
-import { unique } from '../common/general';
+import { escapeHtml, unique } from '../common/general';
 import { ActiveItemService } from '../common/item.service';
 import { i18n } from '../common/locale.service';
 import { notifyError, notifySuccess } from '../common/notifications';
@@ -250,7 +250,7 @@ export class ZonesStateService {
         const details = await openConfirmModal(
             {
                 title: `Remove trigger`,
-                content: `<p>Are you sure you want remove trigger "${trigger.name}"?</p><p>Configuration will be updated <strong>immediately</strong>.</p>`,
+                content: `<p>Are you sure you want remove trigger "${escapeHtml(trigger.name)}"?</p><p>Configuration will be updated <strong>immediately</strong>.</p>`,
                 icon: { type: 'icon', content: 'delete' },
             },
             this._dialog,
@@ -347,7 +347,7 @@ export class ZonesStateService {
             {
                 title: i18n('ZONES.GROUP_REMOVE'),
                 content: i18n('ZONES.GROUP_REMOVE_MSG', {
-                    name: item.group?.name || item.group_id,
+                    name: escapeHtml(item.group?.name || item.group_id),
                 }),
                 icon: { type: 'icon', content: 'delete' },
             },
diff --git a/src/tests/common/general.spec.ts b/src/tests/common/general.spec.ts
index 4e6133ba8..cff523516 100644
--- a/src/tests/common/general.spec.ts
+++ b/src/tests/common/general.spec.ts
@@ -4,6 +4,7 @@ import {
     csvToJson,
     detectIE,
     downloadFile,
+    escapeHtml,
     eventToPoint,
     flatten,
     getItemWithKeys,
@@ -156,6 +157,19 @@ describe('general.ts utilities', () => {
         });
     });
 
+    describe('escapeHtml', () => {
+        it('escapes HTML special characters', () => {
+            expect(escapeHtml(`<img src=x onerror="a('b')">&`)).toBe(
+                '&lt;img src=x onerror=&quot;a(&#39;b&#39;)&quot;&gt;&amp;',
+            );
+        });
+
+        it('returns an empty string for null or undefined', () => {
+            expect(escapeHtml(null)).toBe('');
+            expect(escapeHtml(undefined)).toBe('');
+        });
+    });
+
     describe('unique', () => {
         it('should remove duplicate primitives', () => {
             const arr = [1, 2, 2, 3, 3, 3];
diff --git a/src/tests/users/user-lifecycle.spec.ts b/src/tests/users/user-lifecycle.spec.ts
index 461891274..76f6b7138 100644
--- a/src/tests/users/user-lifecycle.spec.ts
+++ b/src/tests/users/user-lifecycle.spec.ts
@@ -39,7 +39,10 @@ vi.mock('../../app/common/hotkeys.service', () => ({
 vi.mock('../../app/common/settings.service', () => ({
     SettingsService: class {},
 }));
-vi.mock('../../app/common/general', () => ({ log: vi.fn() }));
+vi.mock('../../app/common/general', async () => ({
+    ...(await vi.importActual('../../app/common/general')),
+    log: vi.fn(),
+}));
 vi.mock('../../app/common/notifications', () => ({
     notifyError: vi.fn(),
     notifySuccess: vi.fn(),

From 9abbb751672133d1bb3abc0aa521aa92e07cc88a Mon Sep 17 00:00:00 2001
From: Alex Sorafumo <alex@yuion.net>
Date: Wed, 30 Sep 2026 11:02:21 +1000
Subject: [PATCH 02/10] fix(app): drop unused x-api-key URL param handler

setupPlace passes ignore_api_key, so ts-client never uses a stored API
key. The handler only wrote the key and trusted=true to localStorage,
and the trusted flag changes the OAuth flow.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 src/app/app.ts | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/src/app/app.ts b/src/app/app.ts
index 4c0d411c6..15ad09416 100644
--- a/src/app/app.ts
+++ b/src/app/app.ts
@@ -7,7 +7,6 @@ import {
     invalidateToken,
     isMock,
     isOnline,
-    setAPI_Key,
     token,
 } from '@placeos/ts-client';
 
@@ -169,9 +168,6 @@ export class AppComponent extends AsyncHandler implements OnInit {
                 this._locale?.setLocale(locale);
                 localStorage.setItem('BACKOFFICE.locale', locale);
             }
-            if (params.has('x-api-key')) {
-                setAPI_Key(params.get('x-api-key'));
-            }
         });
         setNotifyOutlet(this._snackbar);
         setTranslationService(this._locale);

From 8adb6e364472c2c221fc7614ddc1cc3af70ed54e Mon Sep 17 00:00:00 2001
From: Alex Sorafumo <alex@yuion.net>
Date: Wed, 30 Sep 2026 11:03:19 +1000
Subject: [PATCH 03/10] fix(ui): stop bypassing href sanitising for stored URIs

Driver default_uri, repository uri and extension url links used the
safe 'url' pipe, which let javascript: URLs through. Let Angular
sanitise them instead. Reject script schemes in validateURI, and strip
repository credentials with the URL API for both link text and href.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 src/app/admin/extensions.component.ts         |  7 +----
 src/app/common/validation.ts                  |  6 ++++-
 src/app/drivers/driver-about.component.ts     |  4 +--
 .../repositories/repositories.utilities.ts    | 17 ++++++++++++
 .../repository-about.component.ts             |  8 +++---
 src/tests/common/validation.spec.ts           | 10 +++++++
 .../repositories.utilities.spec.ts            | 27 ++++++++++++++++++-
 7 files changed, 64 insertions(+), 15 deletions(-)

diff --git a/src/app/admin/extensions.component.ts b/src/app/admin/extensions.component.ts
index 916737364..97d5b0124 100644
--- a/src/app/admin/extensions.component.ts
+++ b/src/app/admin/extensions.component.ts
@@ -16,7 +16,6 @@ import {
     ConfirmModalData,
 } from '../overlays/confirm-modal.component';
 import { IconComponent } from '../ui/icon.component';
-import { SafePipe } from '../ui/pipes/safe.pipe';
 import { SimpleTableComponent } from '../ui/simple-table.component';
 import { TranslatePipe } from '../ui/translate.pipe';
 import { AdminDataService } from './admin-data.service';
@@ -133,10 +132,7 @@ export interface BackofficeExtension {
                     </div>
                 </ng-template>
                 <ng-template #url_template let-row="row">
-                    <a
-                        class="truncate p-4 underline"
-                        [href]="row.url | safe: 'url'"
-                    >
+                    <a class="truncate p-4 underline" [href]="row.url">
                         {{ row.url }}
                     </a>
                 </ng-template>
@@ -189,7 +185,6 @@ export interface BackofficeExtension {
         MatFormFieldModule,
         MatSelectModule,
         FormsModule,
-        SafePipe,
     ],
 })
 export class PlaceExtensionsComponent implements OnInit {
diff --git a/src/app/common/validation.ts b/src/app/common/validation.ts
index 83f10aae2..887c7fe42 100644
--- a/src/app/common/validation.ts
+++ b/src/app/common/validation.ts
@@ -12,11 +12,15 @@ export const validateIpAddress = (ctrl) =>
             : { pattern: true }
         : null;
 
+/** URI schemes that can run script when used as a link */
+const UNSAFE_URI_SCHEMES = ['javascript', 'vbscript', 'data'];
+
 export const validateURI = (ctrl) => {
     if (!ctrl.value) {
         return null;
     } else {
-        return /\w+:(\/?\/?)[^\s]+?/gim.test(ctrl.value)
+        const match = /^\s*([a-z][a-z0-9+.-]*):(\/?\/?)\S+/i.exec(ctrl.value);
+        return match && !UNSAFE_URI_SCHEMES.includes(match[1].toLowerCase())
             ? null
             : { pattern: true };
     }
diff --git a/src/app/drivers/driver-about.component.ts b/src/app/drivers/driver-about.component.ts
index a21b563ba..95f74a0c1 100644
--- a/src/app/drivers/driver-about.component.ts
+++ b/src/app/drivers/driver-about.component.ts
@@ -11,7 +11,6 @@ import { SettingsFormComponent } from '../ui/forms/settings-form.component';
 import { IconComponent } from '../ui/icon.component';
 import { DateFromPipe } from '../ui/pipes/date-from.pipe';
 import { MarkdownPipe } from '../ui/pipes/markdown.pipe';
-import { SafePipe } from '../ui/pipes/safe.pipe';
 import { TranslatePipe } from '../ui/translate.pipe';
 import { DriverStateService } from './driver-state.service';
 
@@ -34,7 +33,7 @@ import { DriverStateService } from './driver-state.service';
                             <div class="overflow-hidden underline select-all">
                                 <a
                                     class="mono block w-full truncate text-sm"
-                                    [href]="item().default_uri | safe: 'url'"
+                                    [href]="item().default_uri"
                                     target="_blank"
                                     >{{ item().default_uri }}</a
                                 >
@@ -222,7 +221,6 @@ import { DriverStateService } from './driver-state.service';
         DateFromPipe,
         MarkdownPipe,
         RouterModule,
-        SafePipe,
         MatProgressSpinnerModule,
         AsyncPipe,
         DatePipe,
diff --git a/src/app/repositories/repositories.utilities.ts b/src/app/repositories/repositories.utilities.ts
index 97a8ea95a..eccd57c07 100644
--- a/src/app/repositories/repositories.utilities.ts
+++ b/src/app/repositories/repositories.utilities.ts
@@ -54,3 +54,20 @@ export const applyRepositoryFormSchema: SchemaFn<RepositoryFormModel> = (
     });
     required(path.uri);
 };
+
+/**
+ * Remove the username and password from a repository URI, so it is safe to
+ * show and to use as a link. URIs that do not parse (e.g. `git@host:repo`)
+ * only have any `//user:pass@` part removed.
+ */
+export function maskUriCredentials(uri: string): string {
+    if (!uri) return '';
+    try {
+        const url = new URL(uri);
+        url.username = '';
+        url.password = '';
+        return url.href;
+    } catch {
+        return uri.replace(/\/\/[^/\s]*@/, '//');
+    }
+}
diff --git a/src/app/repositories/repository-about.component.ts b/src/app/repositories/repository-about.component.ts
index 915fb05d1..fa721f93c 100644
--- a/src/app/repositories/repository-about.component.ts
+++ b/src/app/repositories/repository-about.component.ts
@@ -7,9 +7,9 @@ import { PlaceRepositoryType } from '@placeos/ts-client';
 import { IconComponent } from '../ui/icon.component';
 import { DateFromPipe } from '../ui/pipes/date-from.pipe';
 import { MarkdownPipe } from '../ui/pipes/markdown.pipe';
-import { SafePipe } from '../ui/pipes/safe.pipe';
 import { TranslatePipe } from '../ui/translate.pipe';
 import { RepositoriesStateService } from './repositories-state.service';
+import { maskUriCredentials } from './repositories.utilities';
 
 @Component({
     selector: 'repository-about',
@@ -108,7 +108,7 @@ import { RepositoriesStateService } from './repositories-state.service';
                     <div class="overflow-hidden underline select-all">
                         <a
                             class="block w-full truncate"
-                            [href]="item().uri | safe: 'url'"
+                            [href]="repo_uri()"
                             target="_blank"
                             >{{ repo_uri() || 'No URI set' }}</a
                         >
@@ -217,7 +217,6 @@ import { RepositoriesStateService } from './repositories-state.service';
         MatProgressSpinnerModule,
         MatRippleModule,
         MatTooltipModule,
-        SafePipe,
         DateFromPipe,
         AsyncPipe,
         DatePipe,
@@ -238,8 +237,9 @@ export class RepositoryAboutComponent {
             ? `${location.origin}/${this.item()?.folder_name}/`
             : `${location.hash}`,
     );
+    /** Repository URI without credentials, used for both the text and link */
     public readonly repo_uri = computed(() =>
-        this.item()?.uri.replace(/\/[a-zA-Z0-9\-.:]*@/, '/...@'),
+        maskUriCredentials(this.item()?.uri),
     );
     public readonly is_interface = computed(
         () => this.item()?.type === PlaceRepositoryType.Interface,
diff --git a/src/tests/common/validation.spec.ts b/src/tests/common/validation.spec.ts
index 99f9cb112..d153ac379 100644
--- a/src/tests/common/validation.spec.ts
+++ b/src/tests/common/validation.spec.ts
@@ -127,6 +127,16 @@ describe('validation.ts utilities', () => {
                 const ctrl = { value: '/path/to/file' };
                 expect(validateURI(ctrl)).toEqual({ pattern: true });
             });
+
+            it.each([
+                'javascript:alert(1)',
+                ' JavaScript://%0aalert(1)',
+                'vbscript:msgbox(1)',
+                'data:text/html,<script>alert(1)</script>',
+                'text before javascript:alert(1)',
+            ])('should reject script URI %s', (value) => {
+                expect(validateURI({ value })).toEqual({ pattern: true });
+            });
         });
 
         describe('edge cases', () => {
diff --git a/src/tests/repositories/repositories.utilities.spec.ts b/src/tests/repositories/repositories.utilities.spec.ts
index ded337952..7f1801dea 100644
--- a/src/tests/repositories/repositories.utilities.spec.ts
+++ b/src/tests/repositories/repositories.utilities.spec.ts
@@ -1,5 +1,8 @@
 import { describe, expect, it, vi } from 'vitest';
-import { generateRepositoryFormModel } from '../../app/repositories/repositories.utilities';
+import {
+    generateRepositoryFormModel,
+    maskUriCredentials,
+} from '../../app/repositories/repositories.utilities';
 
 const mocks = vi.hoisted(() => ({
     PlaceRepositoryType: {
@@ -57,4 +60,26 @@ describe('repositories.utilities', () => {
             });
         });
     });
+
+    describe('maskUriCredentials', () => {
+        it('removes a username and password with special characters', () => {
+            expect(
+                maskUriCredentials(
+                    'https://my_user+1:p%40ss_w%2Bd@github.com/org/repo.git',
+                ),
+            ).toBe('https://github.com/org/repo.git');
+        });
+
+        it('keeps a URI without credentials', () => {
+            expect(maskUriCredentials('https://github.com/org/repo')).toBe(
+                'https://github.com/org/repo',
+            );
+        });
+
+        it('removes credentials from a URI that does not parse', () => {
+            expect(maskUriCredentials('//user:pass@host/repo')).toBe(
+                '//host/repo',
+            );
+        });
+    });
 });

From 33b3e69019c8e55e35678bd17a746e2fa099ae38 Mon Sep 17 00:00:00 2001
From: Alex Sorafumo <alex@yuion.net>
Date: Wed, 30 Sep 2026 11:03:45 +1000
Subject: [PATCH 04/10] fix(admin): sandbox signage plugin embed to an opaque
 origin

Plugin URIs are usually same origin, so allow-same-origin with
allow-scripts gave plugins full access to the backoffice session.
Drop allow-same-origin, match plugin messages on event.source as the
probe already does, and allow only http(s) plugin URIs.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../signage-plugin-embed.component.ts         | 27 ++++++++++---------
 .../signage-plugin-embed.component.spec.ts    |  6 +++++
 2 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/src/app/admin/signage-plugins/signage-plugin-embed.component.ts b/src/app/admin/signage-plugins/signage-plugin-embed.component.ts
index fbbb8839b..b96b85cd9 100644
--- a/src/app/admin/signage-plugins/signage-plugin-embed.component.ts
+++ b/src/app/admin/signage-plugins/signage-plugin-embed.component.ts
@@ -18,14 +18,18 @@ import { SafePipe } from '../../ui/pipes/safe.pipe';
 
 export const SIGNAGE_PLUGIN_API_VERSION = 'signage-plugin/v1';
 
-/** Resolve a plugin URI the same way as the iframe element. */
+/**
+ * Resolve a plugin URI the same way as the iframe element.
+ * Returns `null` for invalid URIs and for schemes other than http(s).
+ */
 export function resolveSignagePluginUrl(
     uri: string,
     base_uri: string,
 ): URL | null {
     if (!uri) return null;
     try {
-        return new URL(uri, base_uri);
+        const url = new URL(uri, base_uri);
+        return ['http:', 'https:'].includes(url.protocol) ? url : null;
     } catch {
         return null;
     }
@@ -87,7 +91,7 @@ export type PluginErrorPayload = {
         @if (plugin_url(); as plugin_url) {
             <iframe
                 #plugin_el
-                sandbox="allow-scripts allow-same-origin"
+                sandbox="allow-scripts"
                 referrerpolicy="no-referrer"
                 [src]="plugin_url.href | safe: 'resource'"
             >
@@ -118,10 +122,6 @@ export class SignagePluginEmbedComponent
     public readonly plugin_url = computed(() =>
         resolveSignagePluginUrl(this.plugin()?.uri, this._document.baseURI),
     );
-    public readonly plugin_origin = computed(
-        () => this.plugin_url()?.origin || '',
-    );
-
     private _handle_messages = (e) => this._handleMessage(e);
 
     public ngOnInit() {
@@ -137,9 +137,10 @@ export class SignagePluginEmbedComponent
         type: SignageHostMessageType,
         payload: PluginConfigPayload | null = null,
     ) {
-        this._plugin_el()?.nativeElement?.contentWindow.postMessage(
+        // The sandboxed frame has an opaque origin, so no origin can be named
+        this._plugin_el()?.nativeElement?.contentWindow?.postMessage(
             { api: SIGNAGE_PLUGIN_API_VERSION, type, payload },
-            this.plugin_origin(),
+            '*',
         );
     }
 
@@ -151,10 +152,10 @@ export class SignagePluginEmbedComponent
         window.addEventListener('message', this._handle_messages);
     }
 
-    private _handleMessage(event) {
-        if (event.origin !== this.plugin_origin()) return;
-        if (event.source !== this._plugin_el()?.nativeElement?.contentWindow)
-            return;
+    private _handleMessage(event: MessageEvent) {
+        // Origin is `'null'` for sandboxed frames, so match the window
+        const frame_window = this._plugin_el()?.nativeElement?.contentWindow;
+        if (!frame_window || event.source !== frame_window) return;
 
         const msg = event.data;
         if (
diff --git a/src/tests/admin/signage-plugin-embed.component.spec.ts b/src/tests/admin/signage-plugin-embed.component.spec.ts
index 9c9ee10ba..dce0a2344 100644
--- a/src/tests/admin/signage-plugin-embed.component.spec.ts
+++ b/src/tests/admin/signage-plugin-embed.component.spec.ts
@@ -29,5 +29,11 @@ describe('SignagePluginEmbedComponent', () => {
         it('rejects an invalid plugin URI', () => {
             expect(resolveSignagePluginUrl('http://[', base_uri)).toBeNull();
         });
+
+        it('rejects a non-http plugin URI', () => {
+            expect(
+                resolveSignagePluginUrl('javascript:alert(1)', base_uri),
+            ).toBeNull();
+        });
     });
 });

From 90e00d031e66d4165a7a5b3d13e79a1958959596 Mon Sep 17 00:00:00 2001
From: Alex Sorafumo <alex@yuion.net>
Date: Wed, 30 Sep 2026 11:04:32 +1000
Subject: [PATCH 05/10] fix(ui): ignore hotkeys when unlisted modifiers are
 held

Single key hotkeys like KeyE fired, and called preventDefault, on
Cmd/Ctrl+E. Skip a key event when Control, Alt or Meta is held and no
combination for that key includes the modifier. Also use
isContentEditable to detect editable focus.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 src/app/common/hotkeys.service.ts        | 35 ++++++++++++++++++--
 src/tests/common/hotkeys.service.spec.ts | 42 ++++++++++++++++++++++++
 2 files changed, 74 insertions(+), 3 deletions(-)

diff --git a/src/app/common/hotkeys.service.ts b/src/app/common/hotkeys.service.ts
index 5c5984037..1fe4b36f0 100644
--- a/src/app/common/hotkeys.service.ts
+++ b/src/app/common/hotkeys.service.ts
@@ -27,6 +27,8 @@ export class HotkeysService {
     private counter = 0;
     /** Last key code to be pressed */
     private last_down: string;
+    /** Modifiers held during the last keydown event */
+    private held_modifiers: string[] = [];
 
     constructor() {
         window.addEventListener('keydown', (event: KeyboardEvent) => {
@@ -37,6 +39,18 @@ export class HotkeysService {
                 return;
             }
             const code = this.mapKey((event.code || '').toLowerCase());
+            this.held_modifiers = this.heldModifiers(event);
+            // Leave e.g. Ctrl+C to the browser if no combination uses Control
+            if (
+                !INVALID_STANDALONE_KEYS.includes(code) &&
+                !this.registered_combos.some(
+                    (combo) =>
+                        combo[combo.length - 1] === code &&
+                        this.allowsModifiers(combo),
+                )
+            ) {
+                return;
+            }
             if (this.last_down !== code) {
                 this.setKeyState(code, ++this.counter);
                 if (this.combo_end.indexOf(code) >= 0) {
@@ -76,7 +90,7 @@ export class HotkeysService {
             this.setKeyState(last_key, null);
             this.updateCombinationEndList();
             const listener = (count: number) => {
-                if (count) {
+                if (count && this.allowsModifiers(combination)) {
                     const presses: number[] = [];
                     if (combination.length > 0) {
                         // Check that keys are pressed
@@ -128,7 +142,7 @@ export class HotkeysService {
         }
 
         // Check for contenteditable elements
-        if (active.getAttribute('contenteditable') === 'true') {
+        if ((active as HTMLElement).isContentEditable) {
             return true;
         }
 
@@ -148,13 +162,28 @@ export class HotkeysService {
         if (
             code.indexOf('alt') >= 0 ||
             code.indexOf('shift') >= 0 ||
-            code.indexOf('control') >= 0
+            code.indexOf('control') >= 0 ||
+            code.indexOf('meta') >= 0
         ) {
             return code.replace('left', '').replace('right', '');
         }
         return code;
     }
 
+    /** List the combination modifiers held during a key event */
+    private heldModifiers(event: KeyboardEvent): string[] {
+        const held: string[] = [];
+        if (event.ctrlKey) held.push('control');
+        if (event.altKey) held.push('alt');
+        if (event.metaKey) held.push('meta');
+        return held;
+    }
+
+    /** Whether the combination includes every modifier currently held */
+    private allowsModifiers(combo: string[]): boolean {
+        return this.held_modifiers.every((key) => combo.includes(key));
+    }
+
     /**
      * Update the list of the last keys in combinations to allow for prevent default actions on pre-existing hotkeys
      */
diff --git a/src/tests/common/hotkeys.service.spec.ts b/src/tests/common/hotkeys.service.spec.ts
index 9702e6c4e..87e1b19b1 100644
--- a/src/tests/common/hotkeys.service.spec.ts
+++ b/src/tests/common/hotkeys.service.spec.ts
@@ -126,6 +126,48 @@ describe('HotkeysService', () => {
         });
     });
 
+    describe('modifier keys', () => {
+        const keyEvent = (
+            type: 'keydown' | 'keyup',
+            code: string,
+            init: KeyboardEventInit = {},
+        ) => {
+            const event = new KeyboardEvent(type, {
+                code,
+                cancelable: true,
+                ...init,
+            });
+            window.dispatchEvent(event);
+            return event;
+        };
+
+        it('ignores a single key combination while Control or Meta is held', () => {
+            const callback = vi.fn();
+            const subscription = service.listen(['KeyE'], callback);
+            for (const init of [{ ctrlKey: true }, { metaKey: true }]) {
+                const event = keyEvent('keydown', 'KeyE', init);
+                keyEvent('keyup', 'KeyE', init);
+                expect(event.defaultPrevented).toBe(false);
+            }
+            expect(callback).not.toHaveBeenCalled();
+            keyEvent('keydown', 'KeyE');
+            keyEvent('keyup', 'KeyE');
+            expect(callback).toHaveBeenCalledTimes(1);
+            subscription?.unsubscribe();
+        });
+
+        it('fires a combination that includes the held modifier', () => {
+            const callback = vi.fn();
+            const subscription = service.listen(['Control', 'KeyK'], callback);
+            keyEvent('keydown', 'ControlLeft', { ctrlKey: true });
+            keyEvent('keydown', 'KeyK', { ctrlKey: true });
+            keyEvent('keyup', 'KeyK', { ctrlKey: true });
+            keyEvent('keyup', 'ControlLeft');
+            expect(callback).toHaveBeenCalledTimes(1);
+            subscription?.unsubscribe();
+        });
+    });
+
     describe('multiple subscriptions', () => {
         it('should allow multiple subscriptions to different combinations', () => {
             const callback1 = vi.fn();

From 9b1e12622da5c98c988a62951b7d45eec21cfae3 Mon Sep 17 00:00:00 2001
From: Alex Sorafumo <alex@yuion.net>
Date: Wed, 30 Sep 2026 11:07:46 +1000
Subject: [PATCH 06/10] fix(ui): save only editable dirty settings levels

The settings form had bare A and C hotkeys for save all and clear, and
save all wrote every level, including masked encrypted (level 3) YAML,
which could overwrite secrets. Move the hotkeys to Alt+Shift, save only
dirty levels the user can edit, and refuse to save encrypted settings
that still hold masked values.

Also mask admin and support levels for lower privilege users (is_admin
and is_support were not called), fix the save guard, push the setting
found by level, and return new arrays from signal updates.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 public/assets/locale/ar.json                  |   1 +
 public/assets/locale/en-AU.json               |   1 +
 public/assets/locale/en-GB.json               |   1 +
 public/assets/locale/en-US.json               |   1 +
 public/assets/locale/es.json                  |   1 +
 public/assets/locale/fr.json                  |   1 +
 public/assets/locale/jp.json                  |   1 +
 src/app/ui/forms/settings-form.component.ts   | 137 +++++++++++-------
 .../settings-form.component.spec.ts           | 107 ++++++++++++++
 9 files changed, 195 insertions(+), 56 deletions(-)
 create mode 100644 src/tests/ui/components/settings-form.component.spec.ts

diff --git a/public/assets/locale/ar.json b/public/assets/locale/ar.json
index 3506a2551..76712cc89 100644
--- a/public/assets/locale/ar.json
+++ b/public/assets/locale/ar.json
@@ -116,6 +116,7 @@
         "SETTINGS_ENCRYPTED": "مشفر",
         "SETTINGS_MERGED": "تم الدمج",
         "SETTINGS_MASKED": "تم إخفاؤه",
+        "SETTINGS_MASKED_ERROR": "استبدل جميع القيم المخفية قبل حفظ الإعدادات المشفرة",
         "SETTINGS_INHERITED": "إعداد موروث من [{{ parent }}]({{ path }})({{ type }})",
         "SETTINGS_LOCAL": "إعداد محلي من {{ type }}",
         "SETTINGS_SAVE_ERROR": "فشل حفظ الإعدادات. الخطأ {{ error }}",
diff --git a/public/assets/locale/en-AU.json b/public/assets/locale/en-AU.json
index c42e61879..479f8f444 100644
--- a/public/assets/locale/en-AU.json
+++ b/public/assets/locale/en-AU.json
@@ -136,6 +136,7 @@
         "SETTINGS_ENCRYPTED": "Encrypted",
         "SETTINGS_MERGED": "Merged",
         "SETTINGS_MASKED": "MASKED",
+        "SETTINGS_MASKED_ERROR": "Replace all masked values before you save encrypted settings",
         "SETTINGS_INHERITED": "Setting inherited from [{{ parent }}]({{ path }})({{ type }})",
         "SETTINGS_LOCAL": "Local setting from {{ type }}",
         "SETTINGS_SAVE_ERROR": "Failed to save settings. Error {{ error }}",
diff --git a/public/assets/locale/en-GB.json b/public/assets/locale/en-GB.json
index 8f6d9c4f1..7d4b66638 100644
--- a/public/assets/locale/en-GB.json
+++ b/public/assets/locale/en-GB.json
@@ -121,6 +121,7 @@
         "SETTINGS_ENCRYPTED": "Encrypted",
         "SETTINGS_MERGED": "Merged",
         "SETTINGS_MASKED": "MASKED",
+        "SETTINGS_MASKED_ERROR": "Replace all masked values before you save encrypted settings",
         "SETTINGS_INHERITED": "Setting inherited from [{{ parent }}]({{ path }})({{ type }})",
         "SETTINGS_LOCAL": "Local setting from {{ type }}",
         "SETTINGS_SAVE_ERROR": "Failed to save settings. Error {{ error }}",
diff --git a/public/assets/locale/en-US.json b/public/assets/locale/en-US.json
index 0269f9b0b..838c470e1 100644
--- a/public/assets/locale/en-US.json
+++ b/public/assets/locale/en-US.json
@@ -118,6 +118,7 @@
         "SETTINGS_ENCRYPTED": "Encrypted",
         "SETTINGS_MERGED": "Merged",
         "SETTINGS_MASKED": "MASKED",
+        "SETTINGS_MASKED_ERROR": "Replace all masked values before you save encrypted settings",
         "SETTINGS_INHERITED": "Setting inherited from [{{ parent }}]({{ path }})({{ type }})",
         "SETTINGS_LOCAL": "Local setting from {{ type }}",
         "SETTINGS_SAVE_ERROR": "Failed to save settings. Error {{ error }}",
diff --git a/public/assets/locale/es.json b/public/assets/locale/es.json
index b49a6a9c5..58d2cfbd6 100644
--- a/public/assets/locale/es.json
+++ b/public/assets/locale/es.json
@@ -116,6 +116,7 @@
         "SETTINGS_ENCRYPTED": "Encriptado",
         "SETTINGS_MERGED": "Combinado",
         "SETTINGS_MASKED": "OCULTO",
+        "SETTINGS_MASKED_ERROR": "Reemplace todos los valores ocultos antes de guardar la configuración cifrada",
         "SETTINGS_INHERITED": "Configuración heredada de [{{ parent }}]({{ path }})({{ type }})",
         "SETTINGS_LOCAL": "Configuración local de {{ type }}",
         "SETTINGS_SAVE_ERROR": "No se pudo guardar las configuraciones. Error {{ error }}",
diff --git a/public/assets/locale/fr.json b/public/assets/locale/fr.json
index a2b5d22d2..70884d172 100644
--- a/public/assets/locale/fr.json
+++ b/public/assets/locale/fr.json
@@ -116,6 +116,7 @@
         "SETTINGS_ENCRYPTED": "Chiffré",
         "SETTINGS_MERGED": "Fusionné",
         "SETTINGS_MASKED": "MASQUÉ",
+        "SETTINGS_MASKED_ERROR": "Remplacez toutes les valeurs masquées avant d'enregistrer les paramètres chiffrés",
         "SETTINGS_INHERITED": "Paramètre hérité de [{{ parent }}]({{ path }})({{ type }})",
         "SETTINGS_LOCAL": "Paramètre local depuis {{ type }}",
         "SETTINGS_SAVE_ERROR": "Échec de l'enregistrement des paramètres. Erreur {{ error }}",
diff --git a/public/assets/locale/jp.json b/public/assets/locale/jp.json
index 22dc438ce..b700ba625 100644
--- a/public/assets/locale/jp.json
+++ b/public/assets/locale/jp.json
@@ -116,6 +116,7 @@
         "SETTINGS_ENCRYPTED": "暗号化済み",
         "SETTINGS_MERGED": "マージ済み",
         "SETTINGS_MASKED": "マスク済み",
+        "SETTINGS_MASKED_ERROR": "暗号化された設定を保存する前に、マスクされた値をすべて置き換えてください",
         "SETTINGS_INHERITED": "この設定は[{{ parent }}]({{ path }})({{ type }})から継承されています",
         "SETTINGS_LOCAL": "{{ type }}のローカル設定",
         "SETTINGS_SAVE_ERROR": "設定の保存に失敗しました。エラー：{{ error }}",
diff --git a/src/app/ui/forms/settings-form.component.ts b/src/app/ui/forms/settings-form.component.ts
index ba9c7b370..a59f3b137 100644
--- a/src/app/ui/forms/settings-form.component.ts
+++ b/src/app/ui/forms/settings-form.component.ts
@@ -409,40 +409,36 @@ export class SettingsFormComponent extends AsyncHandler implements OnInit {
     public ngOnInit(): void {
         this.subscription(
             'save_all',
-            this._hotkey.listen(['KeyA'], () => this.saveAll()),
+            this._hotkey.listen(['Alt', 'Shift', 'KeyA'], () => this.saveAll()),
         );
         this.subscription(
             'clear_all',
-            this._hotkey.listen(['KeyC'], () => this.clearChanges()),
+            this._hotkey.listen(['Alt', 'Shift', 'KeyC'], () =>
+                this.clearChanges(),
+            ),
         );
     }
 
     /** Save changes to the given setting level */
     public save(level: EncryptionLevel) {
         const item = this.used_settings()[level];
-        if (!item && this.saving()[level]) return;
-        this.saving.update((s) => {
-            s[level] = true;
-            return s;
-        });
+        if (!item || this.saving()[level]) return;
+        if (this._hasMaskedValues(level)) {
+            return notifyError(i18n('COMMON.SETTINGS_MASKED_ERROR'));
+        }
+        if (!this._canSave(level)) return;
+        this._setSaving(level, true);
         const details = {
             ...item,
             settings_string: this.settingValue(level),
         };
-        const settings = this.settings();
-        (settings[level].id
-            ? updateSettings(settings[level].id, details)
+        (item.id
+            ? updateSettings(item.id, details)
             : addSettings(details)
         ).then(
             (new_settings: PlaceSettings) => {
-                this.saving.update((s) => {
-                    s[level] = false;
-                    return s;
-                });
-                this.settings.update((s) => {
-                    s[level] = new_settings;
-                    return s;
-                });
+                this._setSaving(level, false);
+                this._setSettings(level, new_settings);
                 notifySuccess(
                     i18n('COMMON.SETTINGS_SAVE_SUCCESS', {
                         type: this.type(level),
@@ -451,10 +447,7 @@ export class SettingsFormComponent extends AsyncHandler implements OnInit {
                 this.clearChanges();
             },
             (err) => {
-                this.saving.update((s) => {
-                    s[level] = false;
-                    return s;
-                });
+                this._setSaving(level, false);
                 notifyError(
                     i18n('COMMON.SETTINGS_SAVE_ERROR', {
                         error: JSON.stringify(
@@ -466,51 +459,43 @@ export class SettingsFormComponent extends AsyncHandler implements OnInit {
         );
     }
 
-    /** Save all changes to settings */
+    /** Save all changed settings levels that the user can edit */
     public saveAll() {
         if (this.has_errors())
             return notifyError('Some of the settings are invalid');
         const promises = [];
+        const saved_levels: number[] = [];
         for (let i = 0; i < EncryptionLevel.NeverDisplay + 1; i++) {
-            const settings = this.settings();
-            if (settings[i] && !this.saving()[i]) {
-                this.saving.update((s) => {
-                    s[i] = true;
-                    return s;
-                });
-                const details = {
-                    ...settings[i],
-                    settings_string: this.settingValue(i),
-                };
-                promises.push(
-                    settings[i].id
-                        ? updateSettings(settings[i].id, details)
-                        : addSettings(details),
-                );
+            if (this.settingDirty(i) && this._hasMaskedValues(i)) {
+                notifyError(i18n('COMMON.SETTINGS_MASKED_ERROR'));
             }
+            const item = this.used_settings()[i];
+            if (!item || this.saving()[i] || !this._canSave(i)) continue;
+            this._setSaving(i, true);
+            saved_levels.push(i);
+            const details = {
+                ...item,
+                settings_string: this.settingValue(i),
+            };
+            promises.push(
+                item.id
+                    ? updateSettings(item.id, details)
+                    : addSettings(details),
+            );
         }
         if (promises.length) {
             Promise.all(promises).then(
                 (results: PlaceSettings[]) => {
-                    for (const result of results) {
-                        this.saving.update((s) => {
-                            s[result.encryption_level] = false;
-                            return s;
-                        });
-                        this.settings.update((s) => {
-                            s[result.encryption_level] = result;
-                            return s;
-                        });
-                    }
+                    results.forEach((result, index) => {
+                        this._setSaving(saved_levels[index], false);
+                        this._setSettings(saved_levels[index], result);
+                    });
                     notifySuccess(i18n('COMMON.SETTINGS_SAVE_SUCCESS_ALL'));
                     this.clearChanges();
                 },
                 (err) => {
-                    for (let i = 0; i < EncryptionLevel.NeverDisplay + 1; i++) {
-                        this.saving.update((s) => {
-                            s[i] = false;
-                            return s;
-                        });
+                    for (const level of saved_levels) {
+                        this._setSaving(level, false);
                     }
                     notifyError(
                         i18n('COMMON.SETTINGS_SAVE_ERROR', {
@@ -524,6 +509,46 @@ export class SettingsFormComponent extends AsyncHandler implements OnInit {
         }
     }
 
+    /** Whether the level has changes the user is allowed to save */
+    private _canSave(level: number) {
+        const option = this.levels().find((i) => i.id === level);
+        return (
+            !!option?.active &&
+            this.settingDirty(level) &&
+            !this._hasMaskedValues(level)
+        );
+    }
+
+    /** Whether encrypted settings still hold masked placeholder values */
+    private _hasMaskedValues(level: number) {
+        return (
+            level === EncryptionLevel.NeverDisplay &&
+            this.settingValue(level).includes(
+                `<${i18n('COMMON.SETTINGS_MASKED')}>`,
+            )
+        );
+    }
+
+    private _setSaving(level: number, state: boolean) {
+        this.saving.update(
+            (s) =>
+                s.map((v, i) => (i === level ? state : v)) as [
+                    boolean,
+                    boolean,
+                    boolean,
+                    boolean,
+                ],
+        );
+    }
+
+    private _setSettings(level: number, new_settings: PlaceSettings) {
+        this.settings.update((s) => {
+            const next = [...(s || [])] as SettingsArray;
+            next[level] = new_settings;
+            return next;
+        });
+    }
+
     public clearChanges() {
         this.used_settings.set(this._processSettings(this.settings() || []));
         this._initForm();
@@ -555,7 +580,7 @@ export class SettingsFormComponent extends AsyncHandler implements OnInit {
                 );
                 continue;
             }
-            processed_settings.push(this._processSetting(settings[i]));
+            processed_settings.push(this._processSetting(setting));
         }
         processed_settings.push(
             this.merge()
@@ -568,9 +593,9 @@ export class SettingsFormComponent extends AsyncHandler implements OnInit {
     private _processSetting(setting: PlaceSettings): PlaceSettings {
         if (
             (setting.encryption_level === EncryptionLevel.Admin &&
-                !this.is_admin) ||
+                !this.is_admin()) ||
             (setting.encryption_level === EncryptionLevel.Support &&
-                !this.is_support) ||
+                !this.is_support()) ||
             setting.encryption_level === EncryptionLevel.NeverDisplay
         ) {
             const obj = {};
diff --git a/src/tests/ui/components/settings-form.component.spec.ts b/src/tests/ui/components/settings-form.component.spec.ts
new file mode 100644
index 000000000..37a8545bc
--- /dev/null
+++ b/src/tests/ui/components/settings-form.component.spec.ts
@@ -0,0 +1,107 @@
+import { provideZonelessChangeDetection, signal } from '@angular/core';
+import { TestBed } from '@angular/core/testing';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+    updateSettings: vi.fn(),
+    addSettings: vi.fn(),
+    notifyError: vi.fn(),
+    user: { sys_admin: true, support: true },
+}));
+
+vi.mock('../../../app/common/notifications', () => ({
+    notifyError: mocks.notifyError,
+    notifySuccess: vi.fn(),
+}));
+
+vi.mock('@placeos/ts-client', () => ({
+    EncryptionLevel: { None: 0, Support: 1, Admin: 2, NeverDisplay: 3 },
+    PlaceSettings: class {
+        constructor(data: Record<string, unknown> = {}) {
+            Object.assign(this, { keys: [], settings_string: '', ...data });
+        }
+    },
+    PlaceUser: class {},
+    updateSettings: mocks.updateSettings,
+    addSettings: mocks.addSettings,
+}));
+
+vi.mock('../../../app/users/users.service', () => ({
+    BackofficeUsersService: class {
+        public currentSignal() {
+            return signal(mocks.user);
+        }
+    },
+}));
+
+import { PlaceSettings } from '@placeos/ts-client';
+import { SettingsFormComponent } from '../../../app/ui/forms/settings-form.component';
+import { BackofficeUsersService } from '../../../app/users/users.service';
+
+const MASK = '<COMMON.SETTINGS_MASKED>';
+
+function createForm() {
+    const component = TestBed.runInInjectionContext(
+        () => new SettingsFormComponent(),
+    );
+    component.settings.set(
+        [0, 1, 2, 3].map(
+            (level) =>
+                new PlaceSettings({
+                    id: `settings-${level}`,
+                    encryption_level: level,
+                    settings_string: `level${level}: value`,
+                    keys: [`level${level}`],
+                } as never),
+        ) as never,
+    );
+    TestBed.tick();
+    return component;
+}
+
+describe('SettingsFormComponent', () => {
+    beforeEach(() => {
+        mocks.user = { sys_admin: true, support: true };
+        mocks.updateSettings.mockReset();
+        mocks.notifyError.mockReset();
+        mocks.updateSettings.mockImplementation((id, details) =>
+            Promise.resolve(details),
+        );
+        TestBed.configureTestingModule({
+            providers: [
+                provideZonelessChangeDetection(),
+                BackofficeUsersService,
+            ],
+        });
+    });
+
+    it('saves only the changed levels', () => {
+        const component = createForm();
+        component.updateSetting(0, 'level0: changed');
+        component.saveAll();
+        expect(mocks.updateSettings).toHaveBeenCalledTimes(1);
+        expect(mocks.updateSettings).toHaveBeenCalledWith(
+            'settings-0',
+            expect.objectContaining({ settings_string: 'level0: changed' }),
+        );
+    });
+
+    it('never saves masked encrypted settings', () => {
+        const component = createForm();
+        expect(component.settingValue(3)).toContain(MASK);
+        component.updateSetting(3, `${component.settingValue(3)}new: key\n`);
+        component.saveAll();
+        component.save(3);
+        expect(mocks.updateSettings).not.toHaveBeenCalled();
+        expect(mocks.notifyError).toHaveBeenCalledWith(
+            'COMMON.SETTINGS_MASKED_ERROR',
+        );
+    });
+
+    it('masks admin settings for support users', () => {
+        mocks.user = { sys_admin: false, support: true };
+        const component = createForm();
+        expect(component.settingValue(1)).toBe('level1: value');
+        expect(component.settingValue(2)).toContain(MASK);
+    });
+});

From e25160360cf4d4b58384a8817f7583a5c9183aec Mon Sep 17 00:00:00 2001
From: Alex Sorafumo <alex@yuion.net>
Date: Wed, 30 Sep 2026 11:09:37 +1000
Subject: [PATCH 07/10] fix(ui): validate extension embed URLs and frame
 messages

The embed query param went straight into the iframe src through a
resource URL bypass, so embed=javascript:... ran script in our origin.
Load it only when it is http(s) and matches an extension URL configured
for the item.

Accept messages only from the frame window and origin, reply to that
origin instead of '*', and ignore invalid JSON. Handle each message
directly, as the per-action timeout dropped all but the last message
of each type.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 src/app/common/api.ts                    | 28 +++++++
 src/app/ui/extension-outlet.component.ts | 93 +++++++++++++++---------
 src/tests/common/api.spec.ts             | 49 ++++++++++++-
 3 files changed, 135 insertions(+), 35 deletions(-)

diff --git a/src/app/common/api.ts b/src/app/common/api.ts
index cbe94aa69..df948213d 100644
--- a/src/app/common/api.ts
+++ b/src/app/common/api.ts
@@ -27,6 +27,34 @@ export function toQueryString(map: HashMap<unknown>) {
     return str;
 }
 
+/**
+ * Check an extension embed URL before it is loaded in an iframe.
+ * Returns the resolved URL if it is http(s) and matches one of the
+ * configured extension URLs for the item, else `null`.
+ * @param embed URL from the `embed` query param
+ * @param allowed_urls Extension URLs from `extensionsForItem`
+ * @param base Base for relative URLs
+ */
+export function allowedEmbedUrl(
+    embed: string,
+    allowed_urls: string[],
+    base = location.origin,
+): string | null {
+    const resolve = (value: string) => {
+        try {
+            const url = new URL(value, base);
+            return ['http:', 'https:'].includes(url.protocol) ? url.href : null;
+        } catch {
+            return null;
+        }
+    };
+    const url = embed ? resolve(embed) : null;
+    if (!url) return null;
+    return allowed_urls.some((allowed) => resolve(allowed) === url)
+        ? url
+        : null;
+}
+
 /**
  * Calculate the index of the module
  * @param module_list List of modules in the parent system
diff --git a/src/app/ui/extension-outlet.component.ts b/src/app/ui/extension-outlet.component.ts
index 66bae2dae..ab4f4f525 100644
--- a/src/app/ui/extension-outlet.component.ts
+++ b/src/app/ui/extension-outlet.component.ts
@@ -17,6 +17,7 @@ import {
     token,
     updateMetadata,
 } from '@placeos/ts-client';
+import { allowedEmbedUrl, extensionsForItem } from '../common/api';
 import { AsyncHandler } from '../common/async-handler.class';
 import { ActiveItemService } from '../common/item.service';
 import { i18n } from '../common/locale.service';
@@ -68,12 +69,28 @@ export class ExtensionOutletComponent extends AsyncHandler {
               : null;
     });
 
+    /** Last embed param that passed the extension URL check */
+    private _verified_embed = '';
+
     public readonly url = signal('');
     public readonly app_loaded = signal(false);
+    private readonly _frame_origin = computed(() =>
+        this.url() ? new URL(this.url()).origin : '',
+    );
 
-    public readonly onMessage = (m) => {
-        if (typeof m.data !== 'string') return;
-        this.handleMessage(JSON.parse(m.data));
+    /** Handle messages sent by the embedded extension frame only */
+    public readonly onMessage = (event: MessageEvent) => {
+        const frame_window = this._frame_el()?.nativeElement?.contentWindow;
+        if (!frame_window || event.source !== frame_window) return;
+        if (event.origin !== this._frame_origin()) return;
+        if (typeof event.data !== 'string') return;
+        let message: FrameMessage;
+        try {
+            message = JSON.parse(event.data);
+        } catch {
+            return;
+        }
+        this.handleMessage(message);
     };
 
     private readonly _frame_el =
@@ -91,11 +108,23 @@ export class ExtensionOutletComponent extends AsyncHandler {
             if (embed === undefined) {
                 return;
             }
-            if (embed) {
-                this.url.set(embed);
-            } else {
+            if (!embed) {
                 this._location.back();
+                return;
             }
+            const item = this._service.item();
+            if (!this._online() || !item || embed === this._verified_embed) {
+                return;
+            }
+            // Only load URLs from the extensions configured for this item
+            const url = allowedEmbedUrl(
+                embed,
+                extensionsForItem(item, this._service.type).map(
+                    (ext) => ext.query.embed,
+                ),
+            );
+            this._verified_embed = url ? embed : '';
+            this.url.set(url || '');
         });
         effect((onCleanup) => {
             window.addEventListener('message', this.onMessage);
@@ -106,34 +135,28 @@ export class ExtensionOutletComponent extends AsyncHandler {
     }
 
     private async handleMessage(message: FrameMessage) {
-        if (!this._frame_el()?.nativeElement) {
-            return this.timeout('not_ready', () => this.handleMessage(message));
+        const item = this._service.active_item;
+        if (message?.type !== 'backoffice' || !item) return;
+        if (message.action === 'update') {
+            // Handle update to item model
+            this.updateItem(item, message);
+        } else if (message.action === 'metadata' && message.name) {
+            // Handle updating metadata
+            this.updateMetadata(item, message);
+        } else if (message.action === 'load' && message.name) {
+            // Handle loading metadata
+            this.loadMetadata(item, message, message.parent);
+        } else if (message.action === 'resource' && message.name) {
+            // Handle loading a resource
+            const url = await this.loadResource(item, message);
+            this._postMessage({
+                id: message.id,
+                type: 'backoffice',
+                status: 'success',
+                content: url,
+                action: 'result',
+            });
         }
-        this.timeout(`on_message:${message.action}`, async () => {
-            const item = this._service.active_item;
-            if (message.type === 'backoffice' && item) {
-                if (message.action === 'update') {
-                    // Handle update to item model
-                    this.updateItem(item, message);
-                } else if (message.action === 'metadata' && message.name) {
-                    // Handle updating metadata
-                    this.updateMetadata(item, message);
-                } else if (message.action === 'load' && message.name) {
-                    // Handle updating metadata
-                    this.loadMetadata(item, message, message.parent);
-                } else if (message.action === 'resource' && message.name) {
-                    // Handle updating metadata
-                    const url = await this.loadResource(item, message);
-                    this._postMessage({
-                        id: message.id,
-                        type: 'backoffice',
-                        status: 'success',
-                        content: url,
-                        action: 'result',
-                    });
-                }
-            }
-        });
     }
 
     private async updateItem(item: PlaceResource, message: FrameMessage) {
@@ -225,9 +248,11 @@ export class ExtensionOutletComponent extends AsyncHandler {
     }
 
     private _postMessage(message: FrameMessage) {
+        const origin = this._frame_origin();
+        if (!origin) return;
         this._frame_el()?.nativeElement?.contentWindow?.postMessage(
             JSON.stringify(message),
-            '*',
+            origin,
         );
     }
 }
diff --git a/src/tests/common/api.spec.ts b/src/tests/common/api.spec.ts
index 6524fc49b..984ebc77d 100644
--- a/src/tests/common/api.spec.ts
+++ b/src/tests/common/api.spec.ts
@@ -7,7 +7,11 @@ vi.mock('@placeos/ts-client', () => ({
     PlaceResource: class {},
 }));
 
-import { toQueryString, calculateModuleIndex } from '../../app/common/api';
+import {
+    allowedEmbedUrl,
+    calculateModuleIndex,
+    toQueryString,
+} from '../../app/common/api';
 
 describe('api.ts utilities', () => {
     describe('toQueryString', () => {
@@ -222,4 +226,47 @@ describe('api.ts utilities', () => {
             expect(index).toBe(2);
         });
     });
+
+    describe('allowedEmbedUrl', () => {
+        const base = 'https://backoffice.example';
+        const allowed = [
+            'https://ext.example/view?id=sys-1',
+            '/local/extension',
+        ];
+
+        it('allows a configured extension URL', () => {
+            expect(
+                allowedEmbedUrl(
+                    'https://ext.example/view?id=sys-1',
+                    allowed,
+                    base,
+                ),
+            ).toBe('https://ext.example/view?id=sys-1');
+        });
+
+        it('resolves a relative extension URL', () => {
+            expect(allowedEmbedUrl('/local/extension', allowed, base)).toBe(
+                'https://backoffice.example/local/extension',
+            );
+        });
+
+        it('rejects script URLs', () => {
+            expect(
+                allowedEmbedUrl('javascript:alert(1)', ['javascript:alert(1)']),
+            ).toBeNull();
+        });
+
+        it('rejects a URL that is not configured', () => {
+            expect(
+                allowedEmbedUrl('https://evil.example/view', allowed, base),
+            ).toBeNull();
+            expect(
+                allowedEmbedUrl(
+                    'https://ext.example/view?id=sys-2',
+                    allowed,
+                    base,
+                ),
+            ).toBeNull();
+        });
+    });
 });

From a638c9b8607a5867ccab7c8adac2cba1d7e2d296 Mon Sep 17 00:00:00 2001
From: Alex Sorafumo <alex@yuion.net>
Date: Wed, 30 Sep 2026 12:23:14 +1000
Subject: [PATCH 08/10] fix(ui): require scheme:// form for driver and module
 URIs

validateURI read the host of `example.com:8080` as a URI scheme, so bare
host:port values passed while `192.168.1.1:80` failed. Require an
explicit `scheme://` form and keep blocking script schemes.

Show the URI error on the driver form, and only validate the module URI
for service and websocket modules, where the field is visible.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 src/app/common/validation.ts                 |  7 ++++-
 src/app/drivers/driver-form.component.ts     | 12 ++++++---
 src/app/modules/modules.utilities.ts         | 14 +++++++---
 src/tests/common/validation.spec.ts          | 28 ++++++++++++++------
 src/tests/drivers/driver-form-schema.spec.ts | 15 +++++++++++
 src/tests/modules/module-form-schema.spec.ts | 17 +++++++++++-
 6 files changed, 76 insertions(+), 17 deletions(-)

diff --git a/src/app/common/validation.ts b/src/app/common/validation.ts
index 887c7fe42..0e17cb0da 100644
--- a/src/app/common/validation.ts
+++ b/src/app/common/validation.ts
@@ -15,11 +15,16 @@ export const validateIpAddress = (ctrl) =>
 /** URI schemes that can run script when used as a link */
 const UNSAFE_URI_SCHEMES = ['javascript', 'vbscript', 'data'];
 
+/**
+ * Validates a driver or module URI. The value must use the explicit
+ * `scheme://rest` form (e.g. `https://host:443/path`, `wss://host`).
+ * Bare `host:port` values are rejected, as are script schemes.
+ */
 export const validateURI = (ctrl) => {
     if (!ctrl.value) {
         return null;
     } else {
-        const match = /^\s*([a-z][a-z0-9+.-]*):(\/?\/?)\S+/i.exec(ctrl.value);
+        const match = /^([a-z][a-z0-9+.-]*):\/\/\S+$/i.exec(ctrl.value);
         return match && !UNSAFE_URI_SCHEMES.includes(match[1].toLowerCase())
             ? null
             : { pattern: true };
diff --git a/src/app/drivers/driver-form.component.ts b/src/app/drivers/driver-form.component.ts
index d92c38680..53e2f1075 100644
--- a/src/app/drivers/driver-form.component.ts
+++ b/src/app/drivers/driver-form.component.ts
@@ -177,15 +177,21 @@ import {
                             [formField]="form.description"
                         ></textarea>
                     </mat-form-field>
-                    <label for="default-uri">{{
-                        'DRIVERS.DEFAULT_URI' | translate
-                    }}</label>
+                    <label
+                        for="default-uri"
+                        [class.error]="fieldInvalid('default_uri')"
+                    >
+                        {{ 'DRIVERS.DEFAULT_URI' | translate }}
+                    </label>
                     <mat-form-field appearance="outline">
                         <input
                             matInput
                             [placeholder]="'DRIVERS.DEFAULT_URI' | translate"
                             [formField]="form.default_uri"
                         />
+                        <mat-error>
+                            {{ 'MODULES.URI_REQUIRED' | translate }}
+                        </mat-error>
                     </mat-form-field>
                     <div class="flex items-center space-x-4">
                         <div class="flex flex-1 flex-col">
diff --git a/src/app/modules/modules.utilities.ts b/src/app/modules/modules.utilities.ts
index d9cbae122..a83a9394f 100644
--- a/src/app/modules/modules.utilities.ts
+++ b/src/app/modules/modules.utilities.ts
@@ -86,11 +86,17 @@ export const applyModuleFormSchema: SchemaFn<ModuleFormModel> = (path) => {
             ? { kind: 'pattern', message: 'Invalid IP address' }
             : undefined,
     );
-    validate(path.uri, ({ value }) =>
-        validateURI({ value: value() })
+    // The URI field is only shown for service/websocket modules, so a hidden
+    // value (e.g. inherited from a device driver) must not block saving
+    validate(path.uri, ({ value, valueOf }) => {
+        const role = valueOf(path.role);
+        const uses_uri =
+            role === PlaceDriverRole.Service ||
+            role === PlaceDriverRole.Websocket;
+        return uses_uri && validateURI({ value: value() })
             ? { kind: 'pattern', message: 'Invalid URI' }
-            : undefined,
-    );
+            : undefined;
+    });
     required(path.uri, {
         when({ valueOf }) {
             const role = valueOf(path.role);
diff --git a/src/tests/common/validation.spec.ts b/src/tests/common/validation.spec.ts
index d153ac379..f108cca7a 100644
--- a/src/tests/common/validation.spec.ts
+++ b/src/tests/common/validation.spec.ts
@@ -106,14 +106,12 @@ describe('validation.ts utilities', () => {
                 expect(validateURI(ctrl)).toBeNull();
             });
 
-            it('should accept mailto:user@example.com', () => {
-                const ctrl = { value: 'mailto:user@example.com' };
-                expect(validateURI(ctrl)).toBeNull();
-            });
-
-            it('should accept custom:scheme', () => {
-                const ctrl = { value: 'custom:scheme' };
-                expect(validateURI(ctrl)).toBeNull();
+            it.each([
+                'wss://example.com/socket',
+                'udp://192.168.1.1:161',
+                'https://192.168.1.1:8443/api',
+            ])('should accept %s', (value) => {
+                expect(validateURI({ value })).toBeNull();
             });
         });
 
@@ -128,8 +126,22 @@ describe('validation.ts utilities', () => {
                 expect(validateURI(ctrl)).toEqual({ pattern: true });
             });
 
+            it.each([
+                '192.168.1.1:80',
+                'example.com:8080',
+                'localhost:80',
+                'mailto:user@example.com',
+                'custom:scheme',
+                'http://',
+                'http://example.com/a b',
+            ])('should reject malformed URI %s', (value) => {
+                expect(validateURI({ value })).toEqual({ pattern: true });
+            });
+
             it.each([
                 'javascript:alert(1)',
+                'javascript://%0aalert(1)',
+                'data://text/html,x',
                 ' JavaScript://%0aalert(1)',
                 'vbscript:msgbox(1)',
                 'data:text/html,<script>alert(1)</script>',
diff --git a/src/tests/drivers/driver-form-schema.spec.ts b/src/tests/drivers/driver-form-schema.spec.ts
index ff5e0e219..988bee278 100644
--- a/src/tests/drivers/driver-form-schema.spec.ts
+++ b/src/tests/drivers/driver-form-schema.spec.ts
@@ -44,4 +44,19 @@ describe('driver form validation', () => {
             expect(fields().valid()).toBe(true);
         },
     );
+
+    it('rejects a default URI without a scheme', () => {
+        const { fields } = createTestForm(
+            {
+                ...generateDriverFormModel(),
+                name: 'Display',
+                module_name: 'Display',
+                default_uri: 'example.com:8080',
+            },
+            applyDriverFormSchema,
+        );
+        expect(fields.default_uri().invalid()).toBe(true);
+        fields.default_uri().value.set('https://example.com:8080');
+        expect(fields().valid()).toBe(true);
+    });
 });
diff --git a/src/tests/modules/module-form-schema.spec.ts b/src/tests/modules/module-form-schema.spec.ts
index d9a3b1fe0..5b3fe2f48 100644
--- a/src/tests/modules/module-form-schema.spec.ts
+++ b/src/tests/modules/module-form-schema.spec.ts
@@ -47,11 +47,26 @@ describe('module form validation', () => {
             expect(fields.uri().invalid()).toBe(true);
             fields.uri().value.set('https://service.example.com');
             expect(fields().valid()).toBe(true);
-            fields.uri().value.set('invalid');
+            fields.uri().value.set('service.example.com:443');
             expect(fields.uri().invalid()).toBe(true);
         },
     );
 
+    it('ignores the hidden URI field for device modules', () => {
+        const { fields } = createTestForm(
+            {
+                ...generateModuleFormModel(),
+                role: PlaceDriverRole.Device,
+                driver_id: 'driver-1',
+                ip: '192.168.1.10',
+                port: 80,
+                uri: '192.168.1.10:80',
+            },
+            applyModuleFormSchema,
+        );
+        expect(fields().valid()).toBe(true);
+    });
+
     it('revalidates connection requirements when switching from device to logic', () => {
         const { fields, model } = createTestForm(
             {

From 8cf3db27963b3e644eff89c7e2ac0dbac493a37f Mon Sep 17 00:00:00 2001
From: Alex Sorafumo <alex@yuion.net>
Date: Wed, 30 Sep 2026 12:23:14 +1000
Subject: [PATCH 09/10] fix(ui): scope hotkeys to the top dialog and ignore
 modifier order

Page hotkeys fired under an open dialog, so "e" in the New User dialog
opened an Edit dialog on top. A listener now belongs to the dialog that
is on top when it registers (or the page) and fires only while that
layer is on top.

Modifier state now comes from the key event flags, so Shift then Alt
then A triggers Alt+Shift+A.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 src/app/common/hotkeys.service.ts        |  88 ++++++++++-----
 src/tests/common/hotkeys.service.spec.ts | 134 ++++++++++++++++++++---
 2 files changed, 178 insertions(+), 44 deletions(-)

diff --git a/src/app/common/hotkeys.service.ts b/src/app/common/hotkeys.service.ts
index 1fe4b36f0..82fc3b3de 100644
--- a/src/app/common/hotkeys.service.ts
+++ b/src/app/common/hotkeys.service.ts
@@ -1,4 +1,9 @@
-import { Service, WritableSignal, signal } from '@angular/core';
+import { Service, WritableSignal, inject, signal } from '@angular/core';
+import {
+    MatDialog,
+    MatDialogRef,
+    MatDialogState,
+} from '@angular/material/dialog';
 
 import { unique } from '../common/general';
 import { SubscriptionLike } from '../common/signals';
@@ -13,8 +18,12 @@ const INVALID_STANDALONE_KEYS: string[] = [
     'os',
 ];
 
+/** Modifier keys whose held state is read from the key event flags */
+const MODIFIER_KEYS: string[] = ['control', 'shift', 'alt', 'meta'];
+
 @Service()
 export class HotkeysService {
+    private _dialog = inject(MatDialog);
     /** Map of signals which store press states of keys */
     private keydown_states: HashMap<WritableSignal<number>> = {};
     /** Map of listeners for key state signals */
@@ -23,11 +32,11 @@ export class HotkeysService {
     private combo_end: string[] = [];
     /** List of registered hotkey combinations */
     private registered_combos: string[][] = [];
-    /** Counter for the number of keydown events. Used for checking order of key presses */
+    /** Counter for the number of keydown events */
     private counter = 0;
     /** Last key code to be pressed */
     private last_down: string;
-    /** Modifiers held during the last keydown event */
+    /** Modifiers (including shift) held during the last keydown event */
     private held_modifiers: string[] = [];
 
     constructor() {
@@ -72,7 +81,10 @@ export class HotkeysService {
     }
 
     /**
-     * Listen to the given key combination
+     * Listen to the given key combination.
+     * Modifiers may be pressed in any order, but the last key must be pressed last.
+     * The listener belongs to the dialog that is on top when it is registered
+     * (or to the page when no dialog is open) and only fires while that layer is on top.
      * @param combo Array of key codes to listen to or a hotkey string e.g. `Alt+Shift+KeyK`
      * @param next Callback for combination presses
      */
@@ -89,29 +101,15 @@ export class HotkeysService {
             const last_key = combination[combination.length - 1];
             this.setKeyState(last_key, null);
             this.updateCombinationEndList();
+            const owner = this.topDialog();
             const listener = (count: number) => {
-                if (count && this.allowsModifiers(combination)) {
-                    const presses: number[] = [];
-                    if (combination.length > 0) {
-                        // Check that keys are pressed
-                        for (const key of combination) {
-                            const state = this.keydown_states[key];
-                            presses.push(state ? state() || -1 : -1);
-                        }
-                        // Check that keys are pressed in the correct order
-                        for (let i = 0; i < combination.length - 1; i++) {
-                            if (presses[i] > presses[i + 1]) {
-                                return;
-                            }
-                        }
-                    }
-                    const total = presses.reduce(
-                        (a, v) => a + (v > 0 ? 1 : -1),
-                        0,
-                    );
-                    if (total >= combination.length) {
-                        next();
-                    }
+                if (
+                    count &&
+                    this.allowsModifiers(combination) &&
+                    this.isActiveLayer(owner) &&
+                    combination.every((key) => this.isPressed(key))
+                ) {
+                    next();
                 }
             };
             this.keydown_listeners[last_key].push(listener);
@@ -170,18 +168,50 @@ export class HotkeysService {
         return code;
     }
 
-    /** List the combination modifiers held during a key event */
+    /** List the modifiers held during a key event */
     private heldModifiers(event: KeyboardEvent): string[] {
         const held: string[] = [];
         if (event.ctrlKey) held.push('control');
+        if (event.shiftKey) held.push('shift');
         if (event.altKey) held.push('alt');
         if (event.metaKey) held.push('meta');
         return held;
     }
 
-    /** Whether the combination includes every modifier currently held */
+    /**
+     * Whether the combination includes every modifier currently held.
+     * Shift is ignored so that it does not block single key hotkeys.
+     */
     private allowsModifiers(combo: string[]): boolean {
-        return this.held_modifiers.every((key) => combo.includes(key));
+        return this.held_modifiers.every(
+            (key) => key === 'shift' || combo.includes(key),
+        );
+    }
+
+    /** Whether the key is held. Modifiers use the event flags, so order does not matter */
+    private isPressed(key: string): boolean {
+        if (MODIFIER_KEYS.includes(key)) {
+            return this.held_modifiers.includes(key);
+        }
+        return (this.keydown_states[key]?.() || 0) > 0;
+    }
+
+    /** Top-most dialog that is open and not closing, or null if there is none */
+    private topDialog(): MatDialogRef<unknown> | null {
+        const open = this._dialog.openDialogs.filter(
+            (ref) => ref.getState() === MatDialogState.OPEN,
+        );
+        return open[open.length - 1] || null;
+    }
+
+    /**
+     * Whether a listener registered while `owner` was on top may fire now.
+     * A listener from a dialog that has since closed is treated as page level.
+     */
+    private isActiveLayer(owner: MatDialogRef<unknown> | null): boolean {
+        const layer =
+            owner && this._dialog.openDialogs.includes(owner) ? owner : null;
+        return this.topDialog() === layer;
     }
 
     /**
diff --git a/src/tests/common/hotkeys.service.spec.ts b/src/tests/common/hotkeys.service.spec.ts
index 87e1b19b1..b79baa4fc 100644
--- a/src/tests/common/hotkeys.service.spec.ts
+++ b/src/tests/common/hotkeys.service.spec.ts
@@ -1,13 +1,46 @@
 import { TestBed } from '@angular/core/testing';
+import { MatDialog, MatDialogState } from '@angular/material/dialog';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { HotkeysService } from '../../app/common/hotkeys.service';
 
 describe('HotkeysService', () => {
     let service: HotkeysService;
+    let open_dialogs: { getState: () => MatDialogState }[];
+
+    const keyEvent = (
+        type: 'keydown' | 'keyup',
+        code: string,
+        init: KeyboardEventInit = {},
+    ) => {
+        const event = new KeyboardEvent(type, {
+            code,
+            cancelable: true,
+            ...init,
+        });
+        window.dispatchEvent(event);
+        return event;
+    };
+
+    const openDialog = () => {
+        const ref = { getState: () => MatDialogState.OPEN };
+        open_dialogs.push(ref);
+        return ref;
+    };
 
     beforeEach(() => {
+        open_dialogs = [];
         TestBed.configureTestingModule({
-            providers: [HotkeysService],
+            providers: [
+                HotkeysService,
+                {
+                    provide: MatDialog,
+                    useValue: {
+                        get openDialogs() {
+                            return open_dialogs;
+                        },
+                    },
+                },
+            ],
         });
         service = TestBed.inject(HotkeysService);
     });
@@ -127,20 +160,6 @@ describe('HotkeysService', () => {
     });
 
     describe('modifier keys', () => {
-        const keyEvent = (
-            type: 'keydown' | 'keyup',
-            code: string,
-            init: KeyboardEventInit = {},
-        ) => {
-            const event = new KeyboardEvent(type, {
-                code,
-                cancelable: true,
-                ...init,
-            });
-            window.dispatchEvent(event);
-            return event;
-        };
-
         it('ignores a single key combination while Control or Meta is held', () => {
             const callback = vi.fn();
             const subscription = service.listen(['KeyE'], callback);
@@ -166,6 +185,91 @@ describe('HotkeysService', () => {
             expect(callback).toHaveBeenCalledTimes(1);
             subscription?.unsubscribe();
         });
+
+        it.each([
+            ['AltLeft', 'ShiftLeft'],
+            ['ShiftLeft', 'AltLeft'],
+        ])(
+            'fires Alt+Shift+A when %s is pressed before %s',
+            (first, second) => {
+                const callback = vi.fn();
+                const subscription = service.listen('Alt+Shift+KeyA', callback);
+                const init = { altKey: true, shiftKey: true };
+                keyEvent('keydown', first, init);
+                keyEvent('keydown', second, init);
+                keyEvent('keydown', 'KeyA', init);
+                keyEvent('keyup', 'KeyA', init);
+                keyEvent('keyup', second);
+                keyEvent('keyup', first);
+                expect(callback).toHaveBeenCalledTimes(1);
+                subscription?.unsubscribe();
+            },
+        );
+
+        it('does not fire a combination when one of its modifiers is missing', () => {
+            const callback = vi.fn();
+            const subscription = service.listen('Alt+Shift+KeyA', callback);
+            keyEvent('keydown', 'AltLeft', { altKey: true });
+            keyEvent('keydown', 'KeyA', { altKey: true });
+            keyEvent('keyup', 'KeyA', { altKey: true });
+            keyEvent('keyup', 'AltLeft');
+            expect(callback).not.toHaveBeenCalled();
+            subscription?.unsubscribe();
+        });
+    });
+
+    describe('dialogs', () => {
+        const press = (code: string) => {
+            keyEvent('keydown', code);
+            keyEvent('keyup', code);
+        };
+
+        it('ignores page hotkeys while a dialog is open', () => {
+            const callback = vi.fn();
+            const subscription = service.listen(['KeyE'], callback);
+            const dialog = openDialog();
+            press('KeyE');
+            expect(callback).not.toHaveBeenCalled();
+            open_dialogs.splice(open_dialogs.indexOf(dialog), 1);
+            press('KeyE');
+            expect(callback).toHaveBeenCalledTimes(1);
+            subscription?.unsubscribe();
+        });
+
+        it('fires hotkeys registered by the top dialog only', () => {
+            openDialog();
+            const first = vi.fn();
+            const first_sub = service.listen(['KeyS'], first);
+            press('KeyS');
+            expect(first).toHaveBeenCalledTimes(1);
+            const nested = openDialog();
+            const second = vi.fn();
+            const second_sub = service.listen(['KeyS'], second);
+            press('KeyS');
+            expect(first).toHaveBeenCalledTimes(1);
+            expect(second).toHaveBeenCalledTimes(1);
+            second_sub?.unsubscribe();
+            open_dialogs.splice(open_dialogs.indexOf(nested), 1);
+            press('KeyS');
+            expect(first).toHaveBeenCalledTimes(2);
+            first_sub?.unsubscribe();
+        });
+
+        it('treats a listener registered during a dialog close as page level', () => {
+            const dialog = {
+                state: MatDialogState.CLOSING,
+                getState() {
+                    return this.state;
+                },
+            };
+            open_dialogs.push(dialog);
+            const callback = vi.fn();
+            const subscription = service.listen(['KeyK'], callback);
+            open_dialogs.splice(0, 1);
+            press('KeyK');
+            expect(callback).toHaveBeenCalledTimes(1);
+            subscription?.unsubscribe();
+        });
     });
 
     describe('multiple subscriptions', () => {

From a9a7fa751c5cd6eba5183fc533bc566c89e2a755 Mon Sep 17 00:00:00 2001
From: Alex Sorafumo <alex@yuion.net>
Date: Wed, 30 Sep 2026 12:23:14 +1000
Subject: [PATCH 10/10] fix(ui): escape item names in search field options

Option labels are rendered with innerHTML, so a name like `<img src=x>`
rendered an image. Escape names and details before building the HTML,
close the detail span, and keep the `<Unnamed>` fallback visible.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../item-search-field.component.ts            | 15 ++++++----
 .../item-search-field.component.spec.ts       | 30 +++++++++++++++++--
 2 files changed, 37 insertions(+), 8 deletions(-)

diff --git a/src/app/ui/custom-fields/item-search-field.component.ts b/src/app/ui/custom-fields/item-search-field.component.ts
index df9aade45..d8b0290e7 100644
--- a/src/app/ui/custom-fields/item-search-field.component.ts
+++ b/src/app/ui/custom-fields/item-search-field.component.ts
@@ -28,6 +28,7 @@ import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatInputModule } from '@angular/material/input';
 import { MatProgressSpinnerModule } from '@angular/material/progress-spinner';
 import { AsyncHandler } from '../../common/async-handler.class';
+import { escapeHtml } from '../../common/general';
 import { HashMap } from '../../common/types';
 import { IconComponent } from '../icon.component';
 import { SanitizePipe } from '../pipes/sanitise.pipe';
@@ -386,6 +387,7 @@ export class ItemSearchFieldComponent<T extends SearchItem>
         this._onTouch?.(this.active_item());
     }
 
+    /** Build the option label HTML for each item. Item values are escaped */
     private _updateNameMap() {
         const map = {};
         const list = this.items || [];
@@ -397,14 +399,15 @@ export class ItemSearchFieldComponent<T extends SearchItem>
                         : item.role === PlaceDriverRole.Logic
                           ? item.control_system_id
                           : item.ip;
-                map[item.id] = `${
-                    item.name || '<Unnamed>'
-                } <span class="small">${detail}<span>`;
+                map[item.id] = `${escapeHtml(
+                    item.name || '<Unnamed>',
+                )} <span class="small">${escapeHtml(detail)}</span>`;
             } else {
-                map[item.id] =
+                map[item.id] = escapeHtml(
                     (item as unknown as { custom_name?: string }).custom_name ||
-                    item.name ||
-                    '<Unnamed>';
+                        item.name ||
+                        '<Unnamed>',
+                );
             }
         }
         this.item_name.set(map);
diff --git a/src/tests/ui/custom-fields/item-search-field.component.spec.ts b/src/tests/ui/custom-fields/item-search-field.component.spec.ts
index b0fe67e65..7d30a3ace 100644
--- a/src/tests/ui/custom-fields/item-search-field.component.spec.ts
+++ b/src/tests/ui/custom-fields/item-search-field.component.spec.ts
@@ -1,6 +1,11 @@
-import { Component, provideZonelessChangeDetection, signal } from '@angular/core';
-import { form, FormField } from '@angular/forms/signals';
+import {
+    Component,
+    provideZonelessChangeDetection,
+    signal,
+} from '@angular/core';
 import { ComponentFixture, TestBed } from '@angular/core/testing';
+import { form, FormField } from '@angular/forms/signals';
+import { PlaceModule } from '@placeos/ts-client';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { ItemSearchFieldComponent } from '../../../app/ui/custom-fields/item-search-field.component';
 
@@ -60,4 +65,25 @@ describe('ItemSearchFieldComponent', () => {
         fixture.detectChanges();
         expect(inputValue()).toBe('Late System');
     });
+
+    it('should escape item names in option labels', async () => {
+        const field = TestBed.createComponent(ItemSearchFieldComponent);
+        const mod = Object.assign(new PlaceModule(), {
+            id: 'mod-1',
+            name: '<img src=x>',
+            role: 2,
+            uri: 'https://a.com/<b>',
+        });
+        field.componentRef.setInput('options', [
+            mod,
+            { id: 'sys-1', name: '' },
+        ]);
+        field.detectChanges();
+        await sleep(50);
+        const names = field.componentInstance.item_name();
+        expect(names['mod-1']).toBe(
+            '&lt;img src=x&gt; <span class="small">https://a.com/&lt;b&gt;</span>',
+        );
+        expect(names['sys-1']).toBe('&lt;Unnamed&gt;');
+    });
 });