Escape dynamic scan result text in UI rendering

README.md

@@ -227,6 +227,13 @@ deno task test
 deno task build
 ```
 
+Manual UI regression check for scan/clean results rendering:
+
+1. Create a removable test file whose name includes `&` in the target game folder.
+2. Add a `!rename` directive to `#keeplist.txt` whose `from` or `to` includes `<test>` text, for example `!rename folder/source.txt -> folder/<test>.txt`.
+3. Run `Scan` so the file appears under `Files To Remove` and the directive appears under `Planned Renames`.
+4. Confirm both sections render the special characters literally instead of interpreting them as HTML.
+
 ## Project Structure
 
 - `main.ts` - desktop UI and command orchestration

main.ts

@@ -578,6 +578,14 @@ function setCleanReady(isReady) {
 function markScanDirty() {
   setCleanReady(false);
 }
+function escapeHtml(value) {
+  return String(value)
+    .replaceAll("&", "&")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&#39;");
+}
 function setResults(data) {
   const el = document.getElementById("fileList");
   const rows = [];
@@ -591,7 +599,7 @@ function setResults(data) {
   if (renames.length === 0) {
     rows.push(\`<div class="result-row result-empty">No renames planned</div>\`);
   } else {
-    rows.push(...renames.map((rename) => \`<div class="result-row">\${rename.from} -> \${rename.to}</div>\`));
+    rows.push(...renames.map((rename) => \`<div class="result-row">\${escapeHtml(rename.from)} -> \${escapeHtml(rename.to)}</div>\`));
   }
   rows.push(\`</div></div>\`);
 
@@ -601,7 +609,7 @@ function setResults(data) {
   if (removals.length === 0) {
     rows.push(\`<div class="result-row result-empty">No files to remove</div>\`);
   } else {
-    rows.push(...removals.map((file) => \`<div class="result-row">\${file}</div>\`));
+    rows.push(...removals.map((file) => \`<div class="result-row">\${escapeHtml(file)}</div>\`));
   }
   rows.push(\`</div></div>\`);