[Security] Escape dynamic CSV import history and error-log content before rendering

[ritikj17]

Description

The Leads page dynamically renders CSV import history and row-level import errors using innerHTML.

While frontend/leads.html already provides an escapeHtml() utility and uses it when rendering lead fields, some values in the CSV import UI are inserted into generated HTML without escaping.

For example, renderImportErrorRows() renders values such as:

• entry.email
• entry.error

and renderImportHistory() renders values such as:

• job.filename

directly into HTML templates.

If any of these values contain unexpected HTML markup, they may be interpreted by the browser instead of displayed as plain text.

Proposed Solution

Ensure all dynamic/import-derived text rendered through innerHTML is safely escaped before insertion.

Where possible:

1. Use the existing escapeHtml() helper for dynamic text values.
2. Consider using textContent when HTML generation is not required.
3. Audit the CSV import history/error rendering functions for similar unsafe interpolation.
4. Preserve the existing UI and functionality.

Files to Modify

• frontend/leads.html

Acceptance Criteria

• CSV filenames are rendered as plain text and cannot inject HTML.
• Imported email/error values are safely escaped before being inserted into innerHTML.
• Existing import-history and error-modal functionality continues to work.
• Legitimate special characters such as <, >, &, ", and ' display correctly.
• No regression occurs in the existing Leads table rendering.

Contribution Request

Hi @Kuldeeep18
I would like to work on this issue as a GSSoC '26 contributor. Please assign this issue to me if it aligns with the project's contribution guidelines.
I will ensure the implementation follows the existing code style and does not introduce regressions.

[ritikj17]

Hi @Kuldeeep18, just following up on this issue. I’d be happy to work on it as part of GSSoC ’26. Could you please review the proposed issue and assign it to me if it’s valid and within the project scope? Thank you!
/assign

[aaniya22]

pls assign this to me under gssoc