fix: add output encoding in script.js

[anupamme]

Summary

Fix critical severity security issue in script.js.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	script.js:293
Assessment	Likely exploitable
CWE	CWE-79

Description: The code extracts values from checked checkbox inputs without validation or sanitization. These values flow through the application data flow and are sent to the server via JSON.stringify(). While display uses escapeHtml(), the lack of input validation on selectedDays values before they enter the data flow creates a DOM-based XSS vulnerability where malicious values can achieve arbitrary JavaScript execution.

Evidence

Exploitation scenario: Attacker crafts malicious webpage that injects JavaScript payloads into checkbox input values.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a private Node.js application (not published to npm). Vulnerabilities affect this application's own runtime only.

Changes

• script.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

Automated security fix by OrbisAI Security

[vercel]

@anupamme is attempting to deploy a commit to the rayatsimar-gmailcom's projects Team on Vercel.

A member of the Team first needs to authorize it.