From b97596bb54545785c2b99ec9db393462801a699e Mon Sep 17 00:00:00 2001
From: PhoenixProject <103653068+EthanThePhoenix38@users.noreply.github.com>
Date: Sat, 14 Feb 2026 13:50:37 +0100
Subject: [PATCH] Potential fix for code scanning alert no. 22: Client-side
 cross-site scripting

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 docs.html | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/docs.html b/docs.html
index 25639930e..a725a7268 100644
--- a/docs.html
+++ b/docs.html
@@ -307,6 +307,17 @@ <h4>On this page</h4>
             return text.toLowerCase().replace(/[^\w]+/g, '-').replace(/^-|-$/g, '');
         }
 
+        // Basic HTML escaping to prevent XSS when inserting untrusted values
+        function escapeHtml(str) {
+            return String(str)
+                .replace(/&/g, '&amp;')
+                .replace(/</g, '&lt;')
+                .replace(/>/g, '&gt;')
+                .replace(/"/g, '&quot;')
+                .replace(/'/g, '&#39;')
+                .replace(/\//g, '&#x2F;');
+        }
+
         // Simple markdown to HTML parser with anchor generation
         function parseMarkdown(md) {
             let html = md;
@@ -389,10 +400,11 @@ <h4>On this page</h4>
 
         // Fetch and display documentation
         async function loadDoc(filename) {
+            const safeFilename = escapeHtml(filename);
             docsContent.innerHTML = `
                 <div class="loading-docs">
                     <div class="loading-spinner"></div>
-                    <p>Loading ${filename}...</p>
+                    <p>Loading ${safeFilename}...</p>
                 </div>
             `;
 
@@ -417,9 +429,9 @@ <h4>On this page</h4>
                 console.error('Error loading doc:', error);
                 docsContent.innerHTML = `
                     <h1>Error Loading Documentation</h1>
-                    <p>Failed to load ${filename}. Please try again later.</p>
+                    <p>Failed to load ${safeFilename}. Please try again later.</p>
                     <p style="margin-top: 20px;">
-                        <a href="https://github.com/${DOCS_CONFIG.owner}/${DOCS_CONFIG.repo}/blob/${DOCS_CONFIG.branch}/${DOCS_CONFIG.docsPath}/${filename}" target="_blank">
+                        <a href="https://github.com/${DOCS_CONFIG.owner}/${DOCS_CONFIG.repo}/blob/${DOCS_CONFIG.branch}/${DOCS_CONFIG.docsPath}/${safeFilename}" target="_blank">
                             View on GitHub
                         </a>
                     </p>