Potential fix for code scanning alert no. 1: Client-side cross-site scripting

[Harivora]

Potential fix for https://github.com/Harivora/ADSC-Website-testing/security/code-scanning/1

In general terms, the problem is caused by directly inserting untrusted strings into HTML content. To fix it, user-provided values like eventName, eventDescription, and others should be safely encoded or sanitized before being embedded into the HTML template. That way, any <, >, ", ', and & characters are converted into safe HTML entities, preventing them from being interpreted as tags or attributes.

The best fix here, without changing behavior, is to sanitize or encode the event details at the point where the HTML template is constructed in lib/email.ts. A small utility function can be added in that file to escape HTML special characters, and then used on each untrusted field before interpolation. For example, define escapeHtml(value: string) that replaces &, <, >, ", and ' with their corresponding HTML entities. Then, inside getEventEmailHtml, call this function for eventDetails.name, eventDetails.description, eventDetails.date, and eventDetails.registerUrl (when used in text or attribute contexts) before embedding them in the template string. This keeps the API contract for sendEmail unchanged, localizes the change to lib/email.ts, and preserves all existing layout/styling while neutralizing HTML injection.

Concretely:

• Edit lib/email.ts.
• Above the templates, add a small escapeHtml helper (no external imports needed).
• Update getEventEmailHtml to:
  • Compute escaped versions: const name = escapeHtml(eventDetails.name);, etc.
  • Use those escaped variables in the HTML template instead of the raw eventDetails.*.
  • For registerUrl, escape for both attribute (href) and text content, and optionally add a simple prefix check (e.g., ensure it starts with http:// or https://) to reduce the chance of javascript: URLs, while staying minimal.

app/api/newsletter/broadcast/route.ts does not need code changes for this specific issue; sanitizing at the template layer is sufficient.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
adsc-atmiya	Error		Feb 7, 2026 5:09pm