Potential fix for code scanning alert no. 6: Unsafe HTML constructed from library input

[projectedanx]

Potential fix for https://github.com/projectedanx/YOURLS/security/code-scanning/6

Best fix: stop constructing yearselect (and adjacent select/day labels) via raw HTML string concatenation with dynamic values. Build DOM nodes with jQuery element constructors, and assign dynamic content with .text(...) (or new Option(...)) so values are treated as text, not HTML.

In js/jquery.cal.js, inside newDatepickerHTML() (around lines 86–99), replace:

• string-built monthselect / yearselect
• the large concatenated <thead> appends using those strings

with safe DOM construction:

• create <select name="month"> and <select name="year"> elements via jQuery('<select ...>')
• append <option> elements using .val(...) and .text(...)
• create the controls row and day-header row with element objects, using .text(...) for localized labels
• append spans for prev/next/today/close using .text(...)

This preserves functionality while removing HTML injection risk from library input.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[gemini-code-assist]

Code Review

This pull request refactors the calendar generation logic in js/jquery.cal.js to construct DOM elements dynamically using jQuery instead of concatenating raw HTML strings, which improves security and maintainability. The feedback suggests replacing the for...in loops used for iterating over months and years with safer alternatives, such as jQuery.each and a standard for loop, to prevent issues with prototype chain extensions and ensure correct iteration order.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.