Potential fix for code scanning alert no. 22: Client-side cross-site scripting

[EthanThePhoenix38]

Potential fix for https://github.com/ThePhoenixAgency/AI-Pulse/security/code-scanning/22

In general, to fix this kind of issue you must ensure that any value deriving from user input (like window.location.hash) is either strictly validated against an allowlist of expected values or properly escaped before being written into HTML via innerHTML, document.write, or similar sinks. Here, the vulnerable usage is in the error template where ${filename} is inserted into HTML.

The minimal, behavior‑preserving fix is:

1. Introduce a small helper function that HTML‑escapes a string (&, <, >, ", ', and / at least).
2. Use this helper to sanitize filename at the point where it is interpolated into the error message HTML (line 418–422).
3. Keep using the original unsanitized filename for non‑HTML contexts (like building the GitHub URL path), because the URL path is constrained by the existing logic via docsNav. However, to be extra defensive, we can also use the escaped version in the GitHub URL; escaping <, >, etc. is safe for URLs in HTML attributes.

Concretely:

• Add a function escapeHtml(str) above loadDoc.
• In loadDoc, compute const safeFilename = escapeHtml(filename);.
• Use safeFilename instead of filename in the error HTML template literal (both in the visible text and the href attribute).

No external libraries are needed; the escaping function is simple and self‑contained. All changes are within docs.html in the shown script block.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

---

Continue Tasks: ▶️ 1 queued — View all

[Copilot]

Pull request overview

This PR addresses a client-side XSS vulnerability (code scanning alert #22) by implementing HTML escaping for user-controlled filename values before they are inserted into the DOM via innerHTML. The vulnerability exists because filenames derived from window.location.hash were being used directly in HTML templates without sanitization.

Changes:

• Added an escapeHtml() function to sanitize strings by escaping HTML special characters (&, <, >, ", ', /)
• Applied HTML escaping to the filename parameter in the loading message and error templates
• Used the sanitized filename in both text content and href attributes to prevent XSS injection

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

While HTML escaping prevents XSS in the displayed content, the filename parameter still comes from user-controlled input (window.location.hash via init()) without validation. Consider adding explicit validation at the start of this function to ensure the filename matches one of the allowed documents. For example, you could define an allowlist of valid filenames (TECHNIQUE.md, READER_MODE_PLAN.md, SUPABASE_MIGRATION.md, ACTION_README.md) and reject any filename that's not in the list. This would provide defense in depth against potential SSRF or path traversal issues when constructing the GitHub API URL on line 413.