From 167133999bf4ad3d2346057a9f42c1f60220fcca Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Sat, 5 Sep 2026 21:30:23 +0000
Subject: [PATCH] fix: V-001 security vulnerability

Automated security fix generated by OrbisAI Security
---
 docs/index.html | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/docs/index.html b/docs/index.html
index aeb9edf..e7a80d8 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -593,6 +593,16 @@
       var res = await fetch('views/api.html')
       var html = await res.text()
       var doc = new DOMParser().parseFromString(html, 'text/html')
+      // Sanitize parsed content before inserting: strip scripts and inline
+      // event handlers / javascript: URLs to avoid XSS from the fetched HTML.
+      doc.querySelectorAll('script').forEach(function (s) { s.remove() })
+      doc.querySelectorAll('*').forEach(function (el) {
+        Array.prototype.slice.call(el.attributes).forEach(function (attr) {
+          if (/^on/i.test(attr.name) || /^javascript:/i.test(attr.value)) {
+            el.removeAttribute(attr.name)
+          }
+        })
+      })
       var styles = ''
       doc.querySelectorAll('style').forEach(function (s) { styles += s.outerHTML })
       var body = doc.body.innerHTML