From e928110fcc3a17f7ba42b16c420241e5aca15ecd Mon Sep 17 00:00:00 2001
From: Anton Petrov <a.petrov.83@gmail.com>
Date: Fri, 28 Aug 2026 20:51:20 +0300
Subject: [PATCH 1/2] Potential fix for code scanning alert no. 6: DOM text
 reinterpreted as HTML

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 staticfiles/js/supplier-crud.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/staticfiles/js/supplier-crud.js b/staticfiles/js/supplier-crud.js
index c746971..202fd91 100644
--- a/staticfiles/js/supplier-crud.js
+++ b/staticfiles/js/supplier-crud.js
@@ -222,7 +222,12 @@ document.addEventListener('DOMContentLoaded', function () {
         card.append('<p>Contact: ' + supplier.contact_name + '</p>');
         card.append('<p>Country: ' + supplier.supplier_country + '</p>');
         card.append('<p>Phone: ' + supplier.phone_number + '</p>');
-        card.append('<p>Email: <a href="mailto:' + supplier.email + '">' + supplier.email + '</a></p>');
+        const emailValue = String(supplier.email || '');
+        const emailParagraph = $('<p></p>');
+        const emailLink = $('<a></a>').attr('href', 'mailto:' + emailValue).text(emailValue);
+        emailParagraph.append(document.createTextNode('Email: '));
+        emailParagraph.append(emailLink);
+        card.append(emailParagraph);
 
         card.on('click', function () {
             showEditForm(supplier.id, supplier.name, supplier.contact_name, supplier.supplier_country, supplier.phone_number, supplier.email);

From 1735aa39dbfdc39207b7bbfcbb643904fbe9ea73 Mon Sep 17 00:00:00 2001
From: Anton Petrov <a.petrov.83@gmail.com>
Date: Fri, 28 Aug 2026 20:56:48 +0300
Subject: [PATCH 2/2] Potential fix for pull request finding 'CodeQL / DOM text
 reinterpreted as HTML'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 staticfiles/js/supplier-crud.js | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/staticfiles/js/supplier-crud.js b/staticfiles/js/supplier-crud.js
index 202fd91..3c7da71 100644
--- a/staticfiles/js/supplier-crud.js
+++ b/staticfiles/js/supplier-crud.js
@@ -224,9 +224,17 @@ document.addEventListener('DOMContentLoaded', function () {
         card.append('<p>Phone: ' + supplier.phone_number + '</p>');
         const emailValue = String(supplier.email || '');
         const emailParagraph = $('<p></p>');
-        const emailLink = $('<a></a>').attr('href', 'mailto:' + emailValue).text(emailValue);
+        const safeEmailValue = emailValue.trim();
+        const isValidEmail = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(safeEmailValue);
         emailParagraph.append(document.createTextNode('Email: '));
-        emailParagraph.append(emailLink);
+        if (isValidEmail) {
+            const emailLink = $('<a></a>')
+                .attr('href', 'mailto:' + encodeURIComponent(safeEmailValue))
+                .text(safeEmailValue);
+            emailParagraph.append(emailLink);
+        } else {
+            emailParagraph.append(document.createTextNode(safeEmailValue));
+        }
         card.append(emailParagraph);
 
         card.on('click', function () {