Fix DOM-based XSS in terminal command echo (workspace.js)

[Copilot]

User input (rawCmd) was interpolated directly into an innerHTML assignment, allowing arbitrary HTML/JS injection via crafted terminal commands (CodeQL alert #3, js/xss-through-dom).

Changes

• sentinelos/js/workspace.js: Replace unsafe innerHTML template literal with explicit DOM construction for the terminal echo line — prompt text set via textContent, user input appended as a createTextNode, ensuring raw input is never parsed as HTML.

// Before — XSS: rawCmd injected into innerHTML
appendTermLine(`<span class="prompt">sentinel@core:~$</span> ${rawCmd}`, true);

// After — safe DOM construction
const echoLine = document.createElement('div');
echoLine.className = 'term-line';
const prompt = document.createElement('span');
prompt.className = 'prompt';
prompt.textContent = 'sentinel@core:~$';
echoLine.appendChild(prompt);
echoLine.appendChild(document.createTextNode(' ' + rawCmd));

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
explorer	Ready	Preview	Aug 8, 2026 3:13pm

[piyyy314]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Mitigates a DOM-based XSS in the terminal command echo by eliminating innerHTML interpolation of user input and constructing the echoed line using safe DOM APIs.

Changes:

• Replaced appendTermLine(..., true) usage with explicit DOM element creation for the echo line.
• Ensured rawCmd is inserted via createTextNode (not parsed as HTML) and prompt text via textContent.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Fixed in the latest commit — the guard now checks only termScreen, and falls back to termScreen.appendChild(echoLine) when cursorLine is absent.

[Copilot]

Fixed in the latest commit. The guard now only checks termScreen, with a fallback to termScreen.appendChild(echoLine) when cursorLine is absent.