From f6183dbbf7e351776776254e68a4229425d40b6e Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Thu, 26 Mar 2026 09:13:24 +0000 Subject: [PATCH] fix: resolve CodeQL alert #47 - Reflected server-side cross-site scripting --- vulnerable_xss.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/vulnerable_xss.py b/vulnerable_xss.py index 59b8652..fdebc9d 100644 --- a/vulnerable_xss.py +++ b/vulnerable_xss.py @@ -32,8 +32,9 @@ def search(): @app.route('/profile') def profile(): - username = request.args.get('user', 'Anonymous') - bio = request.args.get('bio', '') + from markupsafe import escape + username = escape(request.args.get('user', 'Anonymous')) + bio = escape(request.args.get('bio', '')) page = f"""