[Demo][Security] Fix reflected XSS in promo banner

Open Beginner friendly
#8 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
javascript
Domain
frontend, security

Research direction

Start with demo-app/public/app.js and trace how the promo query parameter is rendered. Replace the unsafe HTML rendering with text-only behavior, enforce the requested promo length constraint, and document how benign and unsafe inputs should behave. Done means promo content cannot be interpreted as HTML and the expected behavior is documented.

Written by the indexing model from the issue text.

Description

enhancement

Demo goal

Show a security finding and Copilot remediation workflow.

Problem

demo-app/public/app.js sets promo text using innerHTML from URL query param promo.

Requested change

  • Replace unsafe rendering with safe text-only rendering
  • Add input constraints for promo length
  • Document expected behavior for benign/unsafe input

Presenter cue

Use this issue for Defender + GitHub Code Security remediation narrative.

Files

  • demo-app/public/app.js
Dominant language
HTML
Stars
0
Forks
0
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from beardofedu/copilot-agentic-updates-deck

All issues in beardofedu/copilot-agentic-updates-deck

Similar issues

More Web Dev issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.