Potential fix for code scanning alert no. 1: DOM text reinterpreted as HTML

[byron-infomagnus]

Potential fix for https://github.com/byron-github-school/skills-copilot-codespaces-vscode/security/code-scanning/1

To fix the vulnerability, the application should avoid using untrusted DOM text as HTML without proper encoding. The single best solution in this case is to assign user input to textContent instead of innerHTML. textContent treats input as plain text instead of HTML, ensuring that any HTML meta-characters are not interpreted, and thereby blocking XSS attacks.

Where to change:
In member.js, change line 5 to use textContent instead of innerHTML.

What is needed:

• No new methods or imports are required.
• Only the assignment statement needs to be updated.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull Request Overview

This PR addresses a DOM-based XSS vulnerability by preventing untrusted user input from being interpreted as HTML. The fix changes the assignment method from innerHTML to textContent, which treats the input as plain text rather than parsing it as HTML.

• Replaced innerHTML with textContent to prevent XSS attacks

Comments suppressed due to low confidence (1)

member.js:1

• Corrected spelling of 'skils' to 'skills' in function name.

function skilsMember() {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.