From 14e96a03b19843765d216fca9c0d93b8b5d2fb88 Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Sat, 26 Sep 2026 20:22:51 +0000
Subject: [PATCH] fix: multi_agent.cwe-79 security vulnerability

Automated security fix generated by OrbisAI Security

Signed-off-by: anupamme <mediratta@gmail.com>
---
 template/js/index.js | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/template/js/index.js b/template/js/index.js
index 1a655fd..4f1b924 100644
--- a/template/js/index.js
+++ b/template/js/index.js
@@ -6,6 +6,12 @@ const { html } = require('es5-lit-element')
 const { render } = require('es5-lit-html')
 const config = window.__config || {}
 
+// Only allow http(s) URLs from untrusted external data to prevent
+// javascript: URI based XSS via href attributes
+function safeUrl (url) {
+  return /^https?:\/\//i.test(url) ? url : '#'
+}
+
 // Import custom elements
 require('./page')
 require('./project-list')
@@ -84,7 +90,7 @@ require('nighthawk')({
                               <a href="https://www.github.com/${issue.project.repoOwner}" target="_blank">${issue.project.repoOwner}</a>
                               / <a href="https://www.github.com/${issue.project.repo}" target="_blank">${issue.project.repoName}</a>
                             </span>
-                            <a href="${issue.issue.url}" target="_blank" class="issue-title">${issue.issue.title}</a>
+                            <a href="${safeUrl(issue.issue.url)}" target="_blank" class="issue-title">${issue.issue.title}</a>
                           </li>
                       `
                     })}
@@ -138,7 +144,7 @@ require('nighthawk')({
                           <a href="https://www.github.com/${issue.project.repoOwner}" target="_blank">${issue.project.repoOwner}</a>
                           / <a href="${issue.project.repo}" target="_blank">${issue.project.repoName}</a>
                         </span>
-                        <a href="${issue.issue.url}" target="_blank" class="issue-title">${issue.issue.title}</a>
+                        <a href="${safeUrl(issue.issue.url)}" target="_blank" class="issue-title">${issue.issue.title}</a>
                       </li>
                   `)}
                 </ul>
@@ -165,7 +171,7 @@ require('nighthawk')({
                       <a href="https://www.github.com/${issue.project.repoOwner}" target="_blank">${issue.project.repoOwner}</a>
                       / <a href="${issue.project.repo}" target="_blank">${issue.project.repoName}</a>
                     </span>
-                    <a href="${issue.issue.url}" target="_blank" class="issue-title">${issue.issue.title}</a>
+                    <a href="${safeUrl(issue.issue.url)}" target="_blank" class="issue-title">${issue.issue.title}</a>
                   </li>
               `)}
             </ul>