[shirokuma-xv]

Potential fix for https://github.com/VIUK-Light/Omoi/security/code-scanning/5

To fix this, remove the unsafe string-concatenation navigation and use only URL + searchParams for all redirects. This prevents reinterpreting DOM text in unsafe contexts and ensures encoding is consistently applied.

Best single fix in select.js:

• In the click handler:
  • For selectedLevel === "4": remove the dead/unsafe intermediate assignment and keep only warningUrl creation + searchParams.set("count", selectedCount) + final navigation.
  • For selectedLevel === "3": same pattern with warning3Url.
  • For default branch: remove window.location.href = "question.html?level=" + selectedLevel; ... concatenation block, and keep only questionUrl.searchParams.set("level", selectedLevel) and set("count", selectedCount) followed by navigation.
• Do not change functionality; just eliminate vulnerable/redundant assignments and rely on the already-safe API path.

No new imports or helper methods are needed.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 75566ec2-c157-4e80-a9e2-39cbace7853c

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}