fix(registration): prevent stored XSS in registration success message (#72)

Replace innerHTML with safe DOM methods (createTextNode + textContent)
to prevent stored XSS via crafted username in the registration
success flow.

Also add prettier as devDependency for CI formatting compliance.

Closes #57

Author: rishab11250

frontend/registration.html

@@ -194,7 +194,7 @@ <h1 class="page-title">Join the Leaderboard</h1>
         const target = document.getElementById("welcome-message");
         const lines = [
           {
-            text: `> User record authenticated: ${name}`,
+            text: "> User record authenticated: ",
             color: "var(--green-dim)",
           },
           { text: `> Status: RANK_SYNC_PENDING`, color: "var(--amber)" },
@@ -218,7 +218,13 @@ <h1 class="page-title">Join the Leaderboard</h1>
           const div = document.createElement("div");
 
           if (lineData.text.includes("authenticated")) {
-            div.innerHTML = `> User record authenticated: <span style="color: var(--green)">${name}</span>`;
+            div.appendChild(
+              document.createTextNode("> User record authenticated: "),
+            );
+            const span = document.createElement("span");
+            span.style.color = "var(--green)";
+            span.textContent = name;
+            div.appendChild(span);
           } else {
             div.innerText = lineData.text;
             if (lineData.color) div.style.color = lineData.color;

package-lock.json

@@ -22,5 +22,8 @@
     "axios": "^1.10.0",
     "cors": "^2.8.5",
     "express": "^5.1.0"
+  },
+  "devDependencies": {
+    "prettier": "^3.8.3"
   }
 }