Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/network/html/FilesPage.html`:
- Around line 829-834: The createFolder handler wired via the form's onsubmit
("createFolder(event)") doesn't accept or use the event and thus doesn't prevent
the browser's native submit; update the createFolder function to accept the
event parameter (e.g., function createFolder(event) {...}) and call
event.preventDefault() at the top (or alternatively return false) before
performing the XHR/async logic so the form doesn't perform a normal submit and
cause duplicate requests; ensure the function name createFolder referenced in
the HTML and JS match exactly.
- Around line 557-562: The hover rule for the CSS class .delete-btn-cancel
currently sets background-color to the same value as its non-hover state so
users get no hover feedback; update the .delete-btn-cancel:hover selector to use
a visibly different color (e.g., a slightly darker or lighter shade) or adjust
another property (border-color, box-shadow, filter:brightness) to provide clear
hover feedback while keeping the cancel button visually consistent with
.delete-btn-cancel.
- Around line 1070-1072: The openUploadModal function inserts user-controlled
currentPath into the DOM via uploadPathDisplay.innerHTML causing XSS; change
this to safely render the path by either HTML-escaping currentPath before
setting innerHTML or, simpler and safer, use uploadPathDisplay.textContent (or
create a text node) and append the home SVG separately so raw HTML is never
injected; update references in openUploadModal to set textContent for the path
and only add the SVG via DOM methods, ensuring uploadModal.classList.add('open')
remains unchanged.
- Around line 1468-1471: The modal title insertion uses innerHTML with unescaped
filename (openRenameModal, openMoveModal, openDeleteModal) which allows XSS;
change the implementation to avoid injecting the raw name into innerHTML — set
only the SVG/icon markup via innerHTML (or create the SVG element), then set the
filename using textContent or append a text node to the same container (e.g.,
element with id 'renameItemName', 'moveItemName', 'deleteItemName') so the icon
remains but the filename is rendered as plain text; likewise ensure the
corresponding path inputs ('renameItemPath' etc.) remain unchanged but never
populate any element via innerHTML with untrusted name values.

In `@src/network/html/SettingsPage.html`:
- Around line 387-393: showToast currently creates a new 4s timeout on every
call so earlier timeouts can hide a newer toast; modify showToast to store the
timeout id (e.g., on the toast element via toast._hideTimeout or
toast.dataset.hideTimeout) and call clearTimeout on the existing id before
creating a new setTimeout, then save the new id so repeated calls reset the
timer and prevent premature dismissal.

---

Outside diff comments:
In `@src/network/html/SettingsPage.html`:
- Around line 395-427: The renderControl function can return undefined for
unknown setting.type values which leads to the literal "undefined" being
inserted into the DOM; update renderControl (the function named renderControl)
to handle unknown/unsupported types by returning an empty string ('' ) as the
default fallback (e.g., after the existing type branches) so any unrecognized
setting types produce no output rather than the string "undefined". Ensure the
change covers the branches for 'toggle', 'enum', 'value', and 'string' and that
callers using renderControl(s) will receive a safe string result.

---

Nitpick comments:
In `@src/network/html/FilesPage.html`:
- Around line 790-795: The external anchor linking to
"https://github.com/crosspoint-reader/crosspoint-reader" (the link text
"CrossPoint E-Reader • Open Source") opens in a new tab but lacks security
attributes; update that <a> element in FilesPage.html to include rel="noopener
noreferrer" alongside target="_blank" so the external link uses the recommended
security/privacy attributes.
- Around line 443-445: The CSS rule that currently reads "transition: all 0.15s;
color: var(--accent-color)" is missing a trailing semicolon after the color
declaration; update the rule in FilesPage.html to "transition: all 0.15s; color:
var(--accent-color);" (add the semicolon) and reformat to match surrounding
style so future properties can be added safely.

In `@src/network/html/HomePage.html`:
- Around line 205-209: The external anchor element with href
"https://github.com/crosspoint-reader/crosspoint-reader" (the link text
"CrossPoint E-Reader • Open Source") uses target="_blank" but lacks rel
attributes; update that <a> tag to include rel="noopener noreferrer" to prevent
window.opener attacks and ensure compatibility with older browsers.

In `@src/network/html/SettingsPage.html`:
- Around line 366-371: The external anchor in SettingsPage.html (the <a
href="https://github.com/crosspoint-reader/crosspoint-reader"
target="_blank">CrossPoint E-Reader • Open Source</a> link) opens a new tab but
is missing the security attributes; update that anchor element to include
rel="noopener noreferrer" so the link uses the recommended security/safety
attributes when target="_blank".
- Around line 265-269: The CSS rule for the selector ".btn-primary:disabled" is
missing a trailing semicolon after "color: var(--muted-color)"; update the
declaration in the .btn-primary:disabled block to add the semicolon so the rule
becomes "color: var(--muted-color);" to match project style and avoid future
parsing issues when adding properties.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/network/html/FilesPage.html`:
- Around line 806-808: The file input with id "fileInput" has no accessible
label; update the markup so the file chooser is announced by assistive tech —
either add a visible <label for="fileInput"> (e.g., "Choose files to upload")
placed before the input or add an aria-label/aria-labelledby attribute on the
input, and ensure any JS handlers (uploadFile(event), validateFile()) still
reference id "fileInput" unchanged; prefer a visible label for usability and
keyboard focus.

---

Duplicate comments:
In `@src/network/html/FilesPage.html`:
- Around line 560-562: The hover rule .delete-btn-cancel:hover currently sets
background-color to `#7f8c8d` which matches the non-hover .delete-btn-cancel, so
change the hover styling to provide visible feedback: update
.delete-btn-cancel:hover to use a different background-color (e.g., a slightly
darker or lighter hex) or add a visual change such as a border or box-shadow;
locate the CSS for .delete-btn-cancel and modify the :hover selector accordingly
to ensure a distinct hover state.
- Around line 790-794: The external anchor element that uses target="_blank"
(the <a href="https://github.com/crosspoint-reader/crosspoint-reader"
target="_blank">CrossPoint E-Reader • Open Source</a>) should include
rel="noopener noreferrer" to prevent tabnabbing and avoid giving the opened page
access to window.opener; update the anchor element where it renders that link to
add rel="noopener noreferrer" alongside target="_blank".
- Around line 1029-1050: The inline onclick attributes (calls to
openDeleteModal, openMoveModal, openRenameModal) are not safely escaping file
names/paths and risk JS injection; replace these inline handlers by storing
sanitized data in data-attributes (e.g., data-name, data-path, data-is-epub)
when building fileTableContent and remove the onclick strings, then add event
delegation listeners (or per-button listeners) that read and JSON.parse/unwrap
those attributes and call openMoveModal/openRenameModal/openDeleteModal;
alternatively, if you must keep inline calls, wrap each arg via JSON.stringify
when inserting into the template (use file.name/filePath through JSON.stringify)
to correctly escape quotes, backslashes and newlines—update the code that
constructs fileTableContent and the button elements (the move-btn, rename-btn,
delete-btn lines) and ensure escapeHtml, FILE_EXTENSION_REGEX and formatFileSize
usage remains unchanged.

---

Nitpick comments:
In `@src/network/html/FilesPage.html`:
- Around line 1296-1298: Remove the unused local variable speed declared in the
upload progress handler (the const speed = '' line) or implement an actual
upload speed calculation and use it in progressText.textContent; locate the
handler that sets progressText.textContent (`progressText`, `file`,
`currentIndex`, `files`, `methodText`, `percent`) and either delete the `speed`
declaration or compute bytes/time delta and replace `speed` with the computed
value in the template so the variable is used.
- Around line 897-930: Extract the repeated inline SVG sprite (symbols like
id="icon-trash", "icon-edit", "icon-folder", etc.) into a single external SVG
sprite file (e.g., sprites.svg) and move duplicated CSS variables/theme styles
into a shared stylesheet (e.g., theme.css); then update FilesPage.html to remove
the embedded <symbol> block and instead reference the shared stylesheet with a
<link rel="stylesheet"> and reference icons with <use
href="sprites.svg#icon-..."> (or the equivalent method your server supports) so
all pages (HomePage, FilesPage, SettingsPage) can reuse the same assets served
as static files. Ensure you keep the same symbol ids (icon-trash, icon-edit,
icon-folder, icon-epub, icon-file, icon-move-file, icon-upload, icon-home,
icon-warning, icon-info) and export the CSS custom properties exactly as they
appear so existing markup and classes continue to work without further changes.

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@src/network/html/FilesPage.html`:
- Around line 1114-1118: The START WebSocket message built in ws.onopen using
ws.send(`START:${file.name}:${file.size}:${currentPath}`) is vulnerable to
delimiter injection from colons in file.name or currentPath; change the protocol
to send a safe payload instead (e.g., JSON or Base64-encoded fields) so the
server can parse unambiguously: replace the START string construction with a
JSON object containing filename, size, and path (or otherwise escape/encode
file.name and currentPath) and update the server to parse that JSON; ensure the
change references ws.onopen, ws.send, and the fields file.name, file.size,
currentPath, and the START message handling on the server.

---

Duplicate comments:
In `@src/network/html/FilesPage.html`:
- Around line 790-794: The external anchor element (the <a> tag with
href="https://github.com/crosspoint-reader/crosspoint-reader" and
target="_blank") is missing rel="noopener noreferrer"; update that anchor to
include rel="noopener noreferrer" alongside target="_blank" to prevent
tabnabbing and ensure the opened page cannot access window.opener.
- Around line 560-562: The .delete-btn-cancel hover rule is identical to its
default state so users get no visual feedback; update the .delete-btn-cancel
:hover selector to visibly differ (for example a slightly lighter/darker
background, a subtle border or box-shadow, or a scale/translate transform) and
add a transition on the base .delete-btn-cancel to animate the change—locate the
.delete-btn-cancel rule and its :hover rule and modify the hover properties and
add transition on the main selector to provide clear hover feedback.
- Line 1029: The inline onclick builds JS string arguments with
file.name.replaceAll("'", "\\'") which fails for backslashes/newlines and can
enable injection; fix by emitting safe JS literals using JSON.stringify for the
values (e.g. change onclick="openDeleteModal('${file.name.replaceAll...}',
'${folderPath.replaceAll...}', true)" to
onclick="openDeleteModal(${JSON.stringify(file.name)},
${JSON.stringify(folderPath)}, true)"), or better, remove the inline onclick and
attach the handler via an event listener reading data attributes (e.g. set
data-name and data-path on the .delete-btn and call openDeleteModal from a
delegated click listener); apply the same change to the other occurrences (lines
around 1047-1049) and update references to fileTableContent, .delete-btn, and
openDeleteModal accordingly.
- Around line 805-807: The file input lacks an accessible label and the
aria-label is incorrectly placed on the paragraph; move the accessibility markup
to the actual input by removing aria-label="fileInput" from the <p> and adding a
proper label associated with the input (either a <label for="fileInput">Select a
file (or multiple files) to upload to <strong
id="uploadPathDisplay"></strong></label> or an aria-label/aria-labelledby on the
input itself), keep the existing id="fileInput", multiple and required
attributes, and ensure existing handlers (validateFile(), uploadFile()) continue
to reference the same id so the code and accessibility are consistent.

---

Nitpick comments:
In `@src/network/html/FilesPage.html`:
- Line 934: The current assignment to currentPath uses decodeURIComponent on the
raw query value and can throw a URIError for malformed percent-encoding; wrap
the decode attempt in a try/catch around the decodeURIComponent(new
URLSearchParams(window.location.search).get('path') || '/') expression (or
decode the retrieved rawPath into a variable first) and on failure fall back to
a safe default (e.g., '/') or the raw undecoded string, and ensure currentPath
is always a string; reference the currentPath variable and the
decodeURIComponent/URLSearchParams(window.location.search).get('path') call when
making the change.