From e72dfab0b6622eeed41c9849ff7c89c85f05331c Mon Sep 17 00:00:00 2001
From: Anton Petrov <a.petrov.83@gmail.com>
Date: Fri, 28 Aug 2026 20:52:47 +0300
Subject: [PATCH 1/2] Potential fix for code scanning alert no. 5: DOM text
 reinterpreted as HTML

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 staticfiles/js/supplier-crud.js | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/staticfiles/js/supplier-crud.js b/staticfiles/js/supplier-crud.js
index c746971..d79ea06 100644
--- a/staticfiles/js/supplier-crud.js
+++ b/staticfiles/js/supplier-crud.js
@@ -218,11 +218,18 @@ document.addEventListener('DOMContentLoaded', function () {
 
     suppliersData.forEach(function (supplier) {
         let card = $('<div class="supplier-card"></div>');
-        card.append('<h5 class="card-title">' + supplier.name + '</h5>');
-        card.append('<p>Contact: ' + supplier.contact_name + '</p>');
-        card.append('<p>Country: ' + supplier.supplier_country + '</p>');
-        card.append('<p>Phone: ' + supplier.phone_number + '</p>');
-        card.append('<p>Email: <a href="mailto:' + supplier.email + '">' + supplier.email + '</a></p>');
+
+        card.append($('<h5 class="card-title"></h5>').text(supplier.name));
+        card.append($('<p></p>').text('Contact: ' + supplier.contact_name));
+        card.append($('<p></p>').text('Country: ' + supplier.supplier_country));
+        card.append($('<p></p>').text('Phone: ' + supplier.phone_number));
+
+        const emailParagraph = $('<p></p>').text('Email: ');
+        const emailLink = $('<a></a>')
+            .attr('href', 'mailto:' + supplier.email)
+            .text(supplier.email);
+        emailParagraph.append(emailLink);
+        card.append(emailParagraph);
 
         card.on('click', function () {
             showEditForm(supplier.id, supplier.name, supplier.contact_name, supplier.supplier_country, supplier.phone_number, supplier.email);

From 08415d04a4378a1014d437d3f2d808bd322bf97e Mon Sep 17 00:00:00 2001
From: Anton Petrov <a.petrov.83@gmail.com>
Date: Fri, 28 Aug 2026 20:54:24 +0300
Subject: [PATCH 2/2] Potential fix for pull request finding 'CodeQL / DOM text
 reinterpreted as HTML'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 staticfiles/js/supplier-crud.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/staticfiles/js/supplier-crud.js b/staticfiles/js/supplier-crud.js
index d79ea06..42e647b 100644
--- a/staticfiles/js/supplier-crud.js
+++ b/staticfiles/js/supplier-crud.js
@@ -225,9 +225,13 @@ document.addEventListener('DOMContentLoaded', function () {
         card.append($('<p></p>').text('Phone: ' + supplier.phone_number));
 
         const emailParagraph = $('<p></p>').text('Email: ');
+        const rawEmail = String(supplier.email || '').trim();
+        const isValidEmail = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(rawEmail);
+        const safeEmail = isValidEmail ? rawEmail : '';
+
         const emailLink = $('<a></a>')
-            .attr('href', 'mailto:' + supplier.email)
-            .text(supplier.email);
+            .attr('href', safeEmail ? ('mailto:' + encodeURIComponent(safeEmail)) : '#')
+            .text(safeEmail || rawEmail);
         emailParagraph.append(emailLink);
         card.append(emailParagraph);