ECSoC_2026: Sanitize URL scanner result rendering

[Babin123456]

Problem

The scanner result card inserts dynamic URL and threat values into HTML.

Current Behavior

User-entered URLs and API-derived threat labels are interpolated into innerHTML.

Why This Improvement Is Needed

Scanner output may include user-controlled values. Rendering those values without escaping can create unsafe UI behavior and makes future changes riskier.

Proposed Solution

Add a small HTML escaping helper and sanitize result titles, descriptions, URLs, and threat tags before rendering.

Expected Outcome

The scanner result UI remains visually identical while handling dynamic values safely.

Additional Notes

This branch intentionally keeps the existing result-card structure.

[khushi-coder337]

Hi @Babin123456 and maintainers,

I'd like to work on this issue.

Proposed Solution
Add a small escapeHtml(str) utility function that escapes & < > " ' — placed in the shared utils/helpers module if one exists, or inline in the scanner result rendering file otherwise.
In the scanner result card rendering logic, wrap every dynamically-inserted value — result title, description, scanned URL, and threat tag — with escapeHtml() before it's interpolated into innerHTML.
Leave the existing result-card DOM structure and styling untouched, so the UI stays visually identical as noted in the issue.
Verify manually by submitting a test URL/threat value containing something like <script> or and confirming it renders as inert text rather than executing. Will add a unit/snapshot test if the repo already has test coverage for this component.

Please assign this to me — happy to adjust the approach if you'd prefer a different sanitization method (e.g. a library like DOMPurify instead of a custom escaper).