From 20e5735bcafc428a62e193ba1102f7c865bb6cc3 Mon Sep 17 00:00:00 2001
From: Lakhan Samani <lakhan.m.samani@gmail.com>
Date: Sat, 4 Apr 2026 11:08:45 +0530
Subject: [PATCH] fix: escape template.JS output, fix GitHub lastName bug, add
 POST logout

- M11: template.JS json func now escapes </script> and <!-- to prevent
  script injection in embedded <script> blocks
- L7: GitHub OAuth assigned firstName to lastName field (name[0] vs name[1])
- L9: Added POST route for /logout alongside existing GET

Fixes: M11 (Medium), L7 (Low), L9 (Low)
---
 internal/http_handlers/oauth_callback.go |  2 +-
 internal/server/http_routes.go           | 10 ++++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/internal/http_handlers/oauth_callback.go b/internal/http_handlers/oauth_callback.go
index 689946c7..8b9690a7 100644
--- a/internal/http_handlers/oauth_callback.go
+++ b/internal/http_handlers/oauth_callback.go
@@ -460,7 +460,7 @@ func (h *httpProvider) processGithubUserInfo(ctx *gin.Context, code string) (*sc
 		firstName = name[0]
 	}
 	if len(name) > 1 && strings.TrimSpace(name[1]) != "" {
-		lastName = name[0]
+		lastName = name[1]
 	}
 
 	picture := userRawData["avatar_url"]
diff --git a/internal/server/http_routes.go b/internal/server/http_routes.go
index af377fac..c4ba7063 100644
--- a/internal/server/http_routes.go
+++ b/internal/server/http_routes.go
@@ -3,6 +3,7 @@ package server
 import (
 	"encoding/json"
 	"html/template"
+	"strings"
 
 	"github.com/gin-gonic/gin"
 )
@@ -31,14 +32,19 @@ func (s *server) NewRouter() *gin.Engine {
 	router.GET("/authorize", s.Dependencies.HTTPProvider.AuthorizeHandler())
 	router.GET("/userinfo", s.Dependencies.HTTPProvider.UserInfoHandler())
 	router.GET("/logout", s.Dependencies.HTTPProvider.LogoutHandler())
+	router.POST("/logout", s.Dependencies.HTTPProvider.LogoutHandler())
 	router.POST("/oauth/token", s.Dependencies.HTTPProvider.TokenHandler())
 	router.POST("/oauth/revoke", s.Dependencies.HTTPProvider.RevokeRefreshTokenHandler())
 
-	// Set up template functions for JSON encoding
+	// Set up template functions for JSON encoding.
+	// Escape </script> and <!-- to prevent script injection in <script> blocks.
 	router.SetFuncMap(template.FuncMap{
 		"json": func(v interface{}) template.JS {
 			a, _ := json.Marshal(v)
-			return template.JS(a)
+			s := string(a)
+			s = strings.ReplaceAll(s, "</", `<\/`)
+			s = strings.ReplaceAll(s, "<!--", `<\!--`)
+			return template.JS(s)
 		},
 	})
 	router.LoadHTMLGlob("web/templates/*")