Escape dashboard HTML payload before rendering

[frantic-openai]

Context

Prevent stored XSS in the dashboard root HTML endpoint by escaping JSON payload characters before rendering.

TL;DR

Escape dashboard JSON output before injecting it into the <pre> element.

Summary

• Add HTML escaping in SymphonyElixir.HttpServer.render_dashboard/3.
• Add regression coverage to verify <script> in dashboard payload is escaped.
• Keep existing dashboard JSON payload shape for safe clients.

Alternatives

• Continue rendering raw JSON and rely on downstream consumers; this remains unsafe for script injection.

Test Plan

• mix test test/symphony_elixir/extensions_test.exs
• make -C elixir all

[Copilot]

Pull request overview

This PR mitigates stored XSS risk in the dashboard root HTML endpoint by HTML-escaping the JSON payload before rendering it into the dashboard <pre> block.

Changes:

• Escape HTML-sensitive characters in SymphonyElixir.HttpServer.render_dashboard/3 before interpolating JSON into the HTML response.
• Add a regression test ensuring <script> content in the dashboard payload is rendered escaped (not executable).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
elixir/lib/symphony_elixir/http_server.ex	Escapes the rendered dashboard JSON payload before embedding in HTML.
elixir/test/symphony_elixir/extensions_test.exs	Adds an end-to-end regression test for HTML escaping in the dashboard root endpoint.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.