Fix XSS via unsanitized innerHTML in JS files

[vagxrth]

Summary

• Replace innerHTML with safe DOM APIs (createElement, textContent, setAttribute) in three JS files to prevent stored XSS from Discourse/GitHub API data
• Add inline URL validation (isSafeUrl) to reject non-HTTP(S) protocols (e.g., javascript:)
• Fix implicit global variables in github-queries.js

Closes #789

Files changed

• js/news-collect.js — landing page news cards
• js/forum-fetch.js — FAQ page topic cards
• js/github-queries.js — GitHub release button and star count

[Copilot]

Pull request overview

This PR addresses a critical stored XSS vulnerability in three JavaScript files that display data from external APIs (Discourse and GitHub). The fix replaces unsafe innerHTML usage with safe DOM manipulation APIs and adds URL protocol validation to prevent malicious script injection.

Changes:

• Replaced all innerHTML assignments with safe DOM APIs (createElement, textContent, setAttribute) in three JS files
• Added isSafeUrl() helper function to validate URL protocols (only allowing http: and https:) before setting href attributes
• Fixed implicit global variable declarations in github-queries.js by adding explicit var keywords

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
js/news-collect.js	Replaced innerHTML with DOM APIs for rendering Discourse news cards; added URL validation for topic links
js/forum-fetch.js	Replaced innerHTML with DOM APIs for FAQ topic cards; added URL validation; changed innerHTML = "" to safer replaceChildren()
js/github-queries.js	Replaced innerHTML with DOM APIs for GitHub release button and star count; fixed implicit global variables (tag, published_at, url, count, date)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MakisH]

Thanks! That's a bit too much code for me to follow right now. Since there is so much activity on this repository right now, maybe someone else would like to take a first closer look?