🔒 Fix potential XSS via innerHTML in app audit tool

[lsb11]

🎯 What: Fixed a potential Cross-Site Scripting (XSS) vulnerability in src/pages/app-audit.astro where user-provided data (app name and cost) was injected into the DOM via string interpolation into innerHTML.

⚠️ Risk: The previous implementation relied on a custom HTML escaping function h() which may not have been robust enough for all contexts, and the cost variable was completely unescaped. This could have allowed a malicious user to craft a specific input (e.g., via a customized link or if this data was ever persisted/shared) that would execute arbitrary JavaScript in another user's browser, potentially leading to session hijacking, defacement, or unauthorized actions.

🛡️ Solution: Replaced the vulnerable innerHTML assignment with safe, native DOM manipulation methods (document.createElement, appendChild, and setting properties like .value and .textContent). By using properties like .value, the browser treats the input strictly as data, entirely mitigating the risk of executing injected HTML or script tags. Additionally, the custom h() escaping is no longer needed when setting .value, preventing double-escaping issues.

---

PR created automatically by Jules for task 15130915846869162552 started by @lsb11

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[cloudflare-workers-and-pages]

Deploying stackarchitect2 with    Cloudflare Pages

Latest commit:	d42735c
Status:	✅  Deploy successful!
Preview URL:	https://b1785b3a.stackarchitect2.pages.dev
Branch Preview URL:	https://fix-xss-app-audit-1513091584.stackarchitect2.pages.dev

View logs