From bc4186dd1f47ce1ab7e5c91f1ff271d4e76f4934 Mon Sep 17 00:00:00 2001 From: anupamme Date: Sat, 29 Aug 2026 03:31:31 +0000 Subject: [PATCH] fix: V-001 security vulnerability Automated security fix generated by OrbisAI Security --- script.js | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/script.js b/script.js index d9d4a323..693d43b8 100644 --- a/script.js +++ b/script.js @@ -267,7 +267,7 @@ function renderSuccess(data) {
Branch${escapeHtml(data.branch)}
Commits${data.commitsCreated}
Date range${escapeHtml(data.startDate)} → ${escapeHtml(data.endDate)}
-
Days${data.selectedDays}
+
Days${escapeHtml(data.selectedDays)}
Pushed${data.pushToRemote ? 'Yes' : 'Dry-run'}

${escapeHtml(pushNote)}

@@ -290,7 +290,10 @@ form.addEventListener('submit', async (event) => { weekdayCounts[input.dataset.weekday] = Number(input.value || 0); }); - const selectedDays = Array.from(document.querySelectorAll("#selectedDays input:checked")).map((input) => input.value); + const VALID_WEEKDAYS = ['monday', 'tuesday', 'wednesday', 'thursday', 'friday', 'saturday', 'sunday']; + const selectedDays = Array.from(document.querySelectorAll("#selectedDays input:checked")) + .map((input) => input.value) + .filter((day) => VALID_WEEKDAYS.includes(day)); const repoOwner = repoOwnerInput.value.trim() || (currentUser ? currentUser.login : ''); const repoName = repoNameInput.value.trim();