XSS in Repo.js via filename