fix: sanitize XSS on login error

frontend/src/lib/components/Login.svelte

@@ -9,7 +9,7 @@
 
 	import { OauthService, UserService, WorkspaceService } from '$lib/gen'
 	import { usersWorkspaceStore, workspaceStore, userStore } from '$lib/stores'
-	import { classNames, emptyString, parseQueryParams } from '$lib/utils'
+	import { classNames, emptyString, escapeHtml, parseQueryParams } from '$lib/utils'
 	import { base } from '$lib/base'
 	import { getUserExt } from '$lib/user'
 	import { sendUserToast } from '$lib/toast'
@@ -264,7 +264,7 @@
 	}
 
 	$effect(() => {
-		error && sendUserToast(error, true)
+		error && sendUserToast(escapeHtml(error), true)
 	})
 </script>
 

frontend/src/lib/utils.ts

@@ -95,6 +95,15 @@ export function isJobSelectable(selectionType: RunsSelectionMode) {
 	return f
 }
 
+export function escapeHtml(unsafe: string) {
+	return unsafe
+		.replace(/&/g, '&')
+		.replace(/</g, '&lt;')
+		.replace(/>/g, '&gt;')
+		.replace(/"/g, '&quot;')
+		.replace(/'/g, '&#039;')
+}
+
 export function validateUsername(username: string): string {
 	if (username != '' && !/^[a-zA-Z]\w+$/.test(username)) {
 		return 'username can only contain letters and numbers and must start with a letter'
@@ -131,7 +140,7 @@ export function displayDateOnly(dateString: string | Date | undefined): string {
 
 export function retrieveCommonWorkerPrefix(workerName: string): string {
 	const lastDashIndex = workerName.lastIndexOf('-')
-	
+
 	return workerName.substring(0, lastDashIndex)
 }