fix(security): 2 improvements across 1 files

[aryanjsingh]

Problem

The page fetches a Markdown file from GitHub, converts it to HTML using marked.js, and injects the result directly into the DOM using .innerHTML. The marked.js library does not sanitize HTML by default. If the README.md file were compromised to include malicious HTML payloads (e.g., <script> tags or onerror event handlers), the code would be executed in the user's browser, leading to a Cross-Site Scripting (XSS) vulnerability. This could allow an attacker to steal user data, hijack sessions, or perform other malicious actions.

Severity: high
File: index.html

Solution

Sanitize the HTML generated by marked.parse() before assigning it to .innerHTML. Use a trusted and well-maintained HTML sanitization library like DOMPurify. You would first include the DOMPurify library and then change the line to: document.querySelector('main').innerHTML = DOMPurify.sanitize(marked.parse(data));.

Changes

• index.html (modified)

Testing

• Existing tests pass
• Manual review completed
• No new warnings/errors introduced