Sanitized query in on-demand query list

[javuto]

Preventing unsanitized queries in the query list, that may lead to XSS.

[Copilot]

Pull request overview

This PR fixes a cross-site scripting (XSS) vulnerability in the on-demand query list by sanitizing user-controlled query data before rendering it in the DataTables interface. The fix prevents malicious queries from executing arbitrary JavaScript when displayed in the admin interface.

Changes:

• Added escapeHTML() and safeHref() helper functions in query.js to sanitize text content and validate URLs
• Refactored the DataTables render function in queries.html to use jQuery DOM creation methods instead of string concatenation, ensuring automatic XSS protection
• Fixed typo in external link target attribute (_target → target)

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
cmd/admin/static/js/query.js	Added escapeHTML() and safeHref() sanitization functions; updated queryResultLink() to use these functions; fixed typo in target attribute
cmd/admin/templates/queries.html	Refactored query column render function to use secure jQuery DOM creation methods instead of calling queryResultLink() with string concatenation

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.