Potential fix for code scanning alert no. 7: Client-side cross-site scripting

client/package.json

@@ -20,7 +20,8 @@
     "concurrently": "^9.1.2",
     "cross-env": "^7.0.3",
     "solid-js": "^1.9.4",
-    "tailwindcss": "^4.0.3"
+    "tailwindcss": "^4.0.3",
+    "dompurify": "^3.2.4"
   },
   "devDependencies": {
     "@neutralinojs/neu": "^11.3.1",

client/src/web/auth.html

@@ -21,6 +21,7 @@
   <script type="module">
     import Neutralino from '@neutralinojs/lib';
     import { init, events } from '@neutralinojs/lib';
+    import DOMPurify from 'dompurify';
 
     const urlParams = new URLSearchParams(window.location.search);
     const connectToken = urlParams.get('connectToken');
@@ -41,7 +42,8 @@
             if (error) {
                 try {
                     const errorObj = JSON.parse(atob(error));
-                    statusText.innerHTML = `<span class="text-red-400">Error: ${JSON.stringify(errorObj)}</span>`;
+                    const sanitizedError = DOMPurify.sanitize(JSON.stringify(errorObj));
+                    statusText.innerHTML = `<span class="text-red-400">Error: ${sanitizedError}</span>`;
                 } catch(parseError) {
                     statusText.innerHTML = '<span class="text-red-400">Error: Invalid error data received</span>';
                 }

server/package.json

@@ -16,7 +16,8 @@
     "discord.js": "^14.14.1",
     "dotenv": "^16.4.5",
     "express": "^4.18.3",
-    "node-fetch": "^2.7.0"
+    "node-fetch": "^2.7.0",
+    "he": "^1.2.0"
   },
   "devDependencies": {
     "nodemon": "^3.1.0"

server/src/AuthServer.js

@@ -1,6 +1,7 @@
 const express = require('express');
 const fetch = require('node-fetch');
 const cors = require('cors');
+const he = require('he');
 
 class AuthServer {
     constructor(discordBot) {
@@ -93,7 +94,7 @@ class AuthServer {
                     const errorData = Buffer.from(JSON.stringify({ error: message })).toString('base64');
                     return res.redirect(`${clientRedirectUri}?error=${errorData}`);
                 } else {
-                    return res.status(400).send(`Authentication error: ${message}. Please close this window and try again.`);
+                    return res.status(400).send(`Authentication error: ${he.encode(message)}. Please close this window and try again.`);
                 }
             };