Fix group document filename XSS in Share controls and cards

[Paul Lizer (paullizer)]

Summary

• Stored group document filenames could execute through Share launchers or card tooltip attributes. Earlier sharing-modal hardening did not protect these rendering boundaries.
• Replace all three filename-bearing inline Share handlers with a shared DOM event-binding helper, and populate card headings/subtitles through textContent and DOM title properties. Cover ordinary and folder views, refreshes, and polling-completion replacement rows.
• Preserve original filenames, Share permissions, document/group status restrictions, and share-count badges. No storage migration, filename rewriting, new dependencies, or CSP changes are required.
• Add focused functional and browser regressions, document the fix, and bump the application to 0.261.029.

Linked issue

Refs GHSA-qwcw-r653-j8c6. The existing security advisory is the tracking reference; no separate issue was created. Advisory publication state and metadata are unchanged.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application: 0.261.028 -> 0.261.029. No deployer changes.

Testing / validation

• Four targeted browser cases reproduced execution before the fix. All 74 isolated Chromium scenarios now pass, exercising rendered Share clicks and card hover, literal filename round-tripping, role/status restrictions, refreshes, and polling completion.
• python -B -m pytest -q .\functional_tests\test_group_document_filename_xss.py .\ui_tests\test_group_document_filename_xss_rendering.py '.\functional_tests\test_stored_xss_share_activity_and_masking_fix.py::test_document_share_modals_use_safe_rendering_and_delegated_clicks' -k 'not implementation_version' -p no:cacheprovider: 78 passed, 1 deselected. After the version bump, python -B .\functional_tests\test_group_document_filename_xss.py: all 4 checks passed.
• python -B .\functional_tests\test_group_workspace_script_declarations.py: 3/3 passed. node --check .\application\single_app\static\js\workspace\group-documents-sharing.js, whitespace checks, the existing sharing-asset XSS check, and changed-production-line XSS checks passed.
• python -B .\functional_tests\test_docs_site_quality.py: 6/6 passed. The standalone documentation inventory check remains 6/7 because of pre-existing XSD upload-label drift. The full historical sharing/activity/masking script also has unrelated stale chat-source expectations and an exact historical version assertion; those were not changed.

Browser coverage executes the production rendering functions, sharing asset, Bootstrap, and modal with intercepted requests. Unrelated UI helpers are stubbed. No live Azure-backed upload or authenticated deployment testing was performed.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Added docs/explanation/fixes/GROUP_DOCUMENT_FILENAME_XSS_FIX.md. Release notes were offered but not approved, so they remain unchanged. No new feature documentation is required.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No routes or frontend settings payloads were added or changed.