Input Validation & Sanitisation

[emperor42]

Several handlers accept arbitrary user input (e.g., filenames in importHandler, query parameters in queryHandler) and embed them directly into HTML without thorough sanitisation. This opens XSS vectors.