If you're going to do this, you need to properly escape everytime you use the dialog:
```
question: StringUtils.format(Strings.Q_DELETE_FILE, file),
```
file needs to be escaped for HTML