From 4fdb87db7b475590794b264e71210e24df2256c2 Mon Sep 17 00:00:00 2001
From: Oskar Eichler <oskar@songstats.com>
Date: Tue, 1 Sep 2026 01:33:15 +0300
Subject: [PATCH] fix: render runtime stack frames as text

---
 overlay/components/RuntimeErrorStack.js       |  8 +++----
 .../components/RuntimeErrorStack.test.js      | 22 +++++++++++++++++++
 2 files changed, 26 insertions(+), 4 deletions(-)
 create mode 100644 test/overlay/components/RuntimeErrorStack.test.js

diff --git a/overlay/components/RuntimeErrorStack.js b/overlay/components/RuntimeErrorStack.js
index 58629877..983a60d5 100644
--- a/overlay/components/RuntimeErrorStack.js
+++ b/overlay/components/RuntimeErrorStack.js
@@ -33,14 +33,14 @@ function RuntimeErrorStack(document, root, props) {
     errorStacks = ErrorStackParser.parse(props.error);
   } catch (e) {
     errorStacks = [];
-    stackContainer.innerHTML = 'No stack trace is available for this error!';
+    stackContainer.textContent = 'No stack trace is available for this error!';
   }
 
   for (let i = 0; i < Math.min(errorStacks.length, 10); i += 1) {
     const currentStack = errorStacks[i];
 
     const functionName = document.createElement('code');
-    functionName.innerHTML = `&emsp;${currentStack.functionName || '(anonymous function)'}`;
+    functionName.textContent = `\u2003${currentStack.functionName || '(anonymous function)'}`;
     functionName.style.color = theme.yellow;
     functionName.style.fontFamily = [
       '"SFMono-Regular"',
@@ -52,8 +52,8 @@ function RuntimeErrorStack(document, root, props) {
     ].join(', ');
 
     const fileName = document.createElement('div');
-    fileName.innerHTML =
-      '&emsp;&emsp;' +
+    fileName.textContent =
+      '\u2003\u2003' +
       utils.formatFilename(currentStack.fileName) +
       ':' +
       currentStack.lineNumber +
diff --git a/test/overlay/components/RuntimeErrorStack.test.js b/test/overlay/components/RuntimeErrorStack.test.js
new file mode 100644
index 00000000..df606115
--- /dev/null
+++ b/test/overlay/components/RuntimeErrorStack.test.js
@@ -0,0 +1,22 @@
+/**
+ * @jest-environment jsdom
+ */
+/* eslint-env browser */
+
+const RuntimeErrorStack = require('../../../overlay/components/RuntimeErrorStack');
+
+describe('RuntimeErrorStack', () => {
+  it('renders stack frame values as text', () => {
+    const root = document.createElement('div');
+    const error = new Error('Failed');
+    error.stack =
+      'Error: Failed\n    at <img src=x onerror=alert(1)> (/tmp/<strong>file</strong>.js:1:2)';
+
+    RuntimeErrorStack(document, root, { error });
+
+    expect(root.querySelector('img')).toBeNull();
+    expect(root.querySelector('strong')).toBeNull();
+    expect(root.textContent).toContain('<img src=x onerror=alert(1)>');
+    expect(root.textContent).toContain('tmp/<strong>file</strong>.js:1:2');
+  });
+});