Refactor installation and runner scripts for enhanced usability and security

- Updated the installation script to clarify that production wrappers do not include fixed test secrets, improving user guidance for local testing.
- Modified the jiggablend-manager and jiggablend-runner scripts to remove fixed test configurations, emphasizing the use of local test credentials via `make init-test`.
- Enhanced error handling in the runner script to ensure that an API key is provided, improving security and user feedback.
- Added new flags and options for the runner, including sandboxing capabilities and GPU ray tracing control, enhancing flexibility for users.
- Improved README documentation to reflect changes in usage and configuration, ensuring users have clear instructions for setup and execution.

web/static/job_new.js

@@ -21,9 +21,19 @@
   const enableExecutionInput = document.getElementById("enable-execution");
 
   let sessionID = "";
+  let detectedBlenderVersion = "";
   let pollTimer = null;
   let uploadInProgress = false;
 
+  function escapeHtml(value) {
+    return String(value ?? "")
+      .replaceAll("&", "&")
+      .replaceAll("<", "&lt;")
+      .replaceAll(">", "&gt;")
+      .replaceAll('"', "&quot;")
+      .replaceAll("'", "&#39;");
+  }
+
   function showError(msg) {
     errorEl.textContent = msg || "";
     errorEl.classList.toggle("hidden", !msg);
@@ -31,7 +41,10 @@
 
   function showStatus(msg) {
     statusEl.classList.remove("hidden");
-    statusEl.innerHTML = `<p>${msg}</p>`;
+    statusEl.replaceChildren();
+    const p = document.createElement("p");
+    p.textContent = msg || "";
+    statusEl.appendChild(p);
   }
 
   function setUploadBusy(busy) {
@@ -68,8 +81,9 @@
       outputFormatInput.value = "EXR";
     }
 
-    if (metadata.blender_version && blendVersionEl.querySelector(`option[value="${metadata.blender_version}"]`)) {
-      blendVersionEl.value = metadata.blender_version;
+    detectedBlenderVersion = metadata.blender_version || "";
+    if (detectedBlenderVersion && blendVersionEl.querySelector(`option[value="${detectedBlenderVersion}"]`)) {
+      blendVersionEl.value = detectedBlenderVersion;
     } else {
       blendVersionEl.value = "";
     }
@@ -80,12 +94,12 @@
     const scenes = metadata.scene_info || {};
     metadataPreview.innerHTML = `
       <div class="metadata-grid">
-        <div><strong>Detected file:</strong> ${status.file_name || fileName || "-"}</div>
-        <div><strong>Frames:</strong> ${metadata.frame_start ?? "-"} - ${metadata.frame_end ?? "-"}</div>
-        <div><strong>Render engine:</strong> ${render.engine || "-"}</div>
-        <div><strong>Resolution:</strong> ${render.resolution_x || "-"} x ${render.resolution_y || "-"}</div>
-        <div><strong>Frame rate:</strong> ${render.frame_rate || "-"}</div>
-        <div><strong>Objects:</strong> ${scenes.object_count ?? "-"}</div>
+        <div><strong>Detected file:</strong> ${escapeHtml(status.file_name || fileName || "-")}</div>
+        <div><strong>Frames:</strong> ${escapeHtml(metadata.frame_start ?? "-")} - ${escapeHtml(metadata.frame_end ?? "-")}</div>
+        <div><strong>Render engine:</strong> ${escapeHtml(render.engine || "-")}</div>
+        <div><strong>Resolution:</strong> ${escapeHtml(render.resolution_x || "-")} x ${escapeHtml(render.resolution_y || "-")}</div>
+        <div><strong>Frame rate:</strong> ${escapeHtml(render.frame_rate || "-")}</div>
+        <div><strong>Objects:</strong> ${escapeHtml(scenes.object_count ?? "-")}</div>
       </div>
     `;
   }
@@ -180,6 +194,7 @@
 
   function resetToUploadStep(message) {
     sessionID = "";
+    detectedBlenderVersion = "";
     clearInterval(pollTimer);
     setUploadBusy(false);
     mainBlendWrapper.classList.add("hidden");
@@ -264,7 +279,7 @@
       unhide_objects: Boolean(fd.get("unhide_objects")),
       enable_execution: Boolean(fd.get("enable_execution")),
     };
-    const blenderVersion = fd.get("blender_version");
+    const blenderVersion = fd.get("blender_version") || detectedBlenderVersion;
     if (blenderVersion) payload.blender_version = blenderVersion;
 
     const job = await createJob(payload);