Sync from GitHub

classic/index.html

@@ -152,7 +152,9 @@ async function load() {
   try {
     if (engine) { const old = engine; engine = null; await old.dispose(); }
     engine = await m.Engine.load(null, {
-      url: q.get('url') || undefined, root: ROOT, gpuBudgetBytes: budgetGB * 1e9, maxCtx,
+      // a model URL from the address bar only on this machine: on a deployed copy a crafted link could store other
+      // weights under this model's name
+      url: (['localhost', '127.0.0.1'].includes(location.hostname) && q.get('url')) || undefined, root: ROOT, gpuBudgetBytes: budgetGB * 1e9, maxCtx,
       onProgress: (e) => {
         if (e.status === 'ingest-plan' && e.quota && e.quota - (e.usage || 0) < e.needed)
           status(`Needs ${GB(e.needed)} of storage; the browser grants ${GB(e.quota - (e.usage || 0))} so far and raises that as the download writes, while the disk has room.`);

index.html

@@ -177,7 +177,7 @@ function renderModels() {
     const s = byName[m.name], el = document.createElement('div');
     el.className = 'mrow' + (loaded && loaded.name === m.name ? ' on' : '');
     const state = !s ? 'not stored' : s.partial ? `${GB(s.size)} of ${GB(m.size)} stored` : 'stored';
-    const name = document.createElement('div'); name.innerHTML = `<b>${m.label}</b>`;
+    const name = document.createElement('div'); name.append(Object.assign(document.createElement('b'), { textContent: m.label }));  // a stored file's own name: text, never markup
     const act = document.createElement('div'); act.className = 'act';
     const info = document.createElement('div'); info.className = 'info'; info.textContent = `${GB(m.size)} · ${state} · ${m.note}`;
     const btn = (label, fn, cls, key) => { const b = document.createElement('button'); b.textContent = label; if (cls) b.className = cls; if (key) b.dataset.act = key; b.onclick = fn; act.append(b); };