[Bluebotlabs]

Originally Posted by GeorgeYellow

This change in 5.6.7 looks mighty suspicious ...

mesquite/browser/javascripts/fileManager.js   2024-02-09 17:54:56.000000000 -0800

+/*
+ * Changes html content to text content
+ */
+function htmlToText(string) {
+    const div = document.createElement('div');
+    div.appendChild(document.createTextNode(string));
+    return div.innerHTML;
+}
+
 /**
  * Manages Browser file upload and download requests
  */
@@ -30,7 +39,8 @@

         // get dialog message
         var mf = new MessageFormat(b.strings.messages.downloadConfirm);
-        var message = mf.format({ filename: request.filename });
+        var filename = htmlToText(request.filename);
+        var message = mf.format({ filename: filename });

I don't suppose there's a way to trigger a download confirmation prompt from a "file:///mnt/us/exploit.html" URL by any chance, or does this require enabling WIFI ?

p e r h a p s
might work on ARMHF toolchain today...