Trigger codeql checks for javascript

[st3iny]

• Resolves: none

Summary

I injected a fake exploit into src/core/ and into dist/. It seems to work correctly and ignore the one inside dist/.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

To fix this code injection vulnerability, we must remove the use of eval on user-controllable input. The best approach is to avoid evaluating any code from the URL entirely. If the intention is to extract a value from the URL (for example, a default value for a form), this should be done by parsing the value and using it as data, not as code. Specifically, we should extract the value of the default parameter from the URL, decode it, and use it as a string or other data type as needed, without evaluating it as code.

Steps:

• Remove the eval call on line 38.
• Replace it with code that safely extracts the value of the default parameter from the URL query string.
• If the value is to be used (e.g., to pre-fill a form), assign it directly to the relevant DOM element or variable, not via eval.
• If the value is not needed, simply remove the line.

Since the code snippet does not show how the extracted value is used, the safest fix is to remove the eval line entirely. If the value is needed, we can show how to extract it safely.

---