Filename HTML injection: entities bypass a raw URL blocklistAn HTML parser decodes URL entities after a raw-string filter runs. Escape filenames at the HTML sink and test every renderer, including generated email.20 April 2026·4 mins