From 3cc421061a07d1008d31653058ee2a15a71007ef Mon Sep 17 00:00:00 2001
From: Frances Coronel <hello@francescoronel.com>
Date: Sun, 1 Dec 2024 12:21:45 -0500
Subject: [PATCH] Fix code scanning alert no. 9: Stored cross-site scripting

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Frances Coronel <fvcproductions@gmail.com>
---
 components/MemberCard/MemberCard.tsx | 4 +++-
 package.json                         | 3 ++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/components/MemberCard/MemberCard.tsx b/components/MemberCard/MemberCard.tsx
index 35b4a8b..d67d2c6 100644
--- a/components/MemberCard/MemberCard.tsx
+++ b/components/MemberCard/MemberCard.tsx
@@ -1,5 +1,6 @@
 import Image from "next/image";
 import Link from "next/link";
+import escapeHtml from "escape-html";
 
 import CountryFlags from "@/components/CountryFlags/CountryFlags";
 import SocialLinks from "@/components/SocialLinks/SocialLinks";
@@ -12,10 +13,11 @@ interface MemberProps {
 
 const MemberCard = (props: MemberProps) => {
   const { name, slug, level, countries } = props.member;
+  const sanitizedPath = escapeHtml(props.member.path);
 
   return (
     <div className={"text-center"}>
-      <Link href={props.member.path} aria-label={name} className="block">
+      <Link href={sanitizedPath} aria-label={name} className="block">
         {/* Image */}
         <Image
           src={`/img/members/${slug}.jpg`}
diff --git a/package.json b/package.json
index 9389866..6b1604b 100644
--- a/package.json
+++ b/package.json
@@ -32,7 +32,8 @@
     "remark-parse": "10.0.1",
     "swr": "^2.1.5",
     "typescript": "5.5.4",
-    "unified": "10.1.2"
+    "unified": "10.1.2",
+    "escape-html": "^1.0.3"
   },
   "devDependencies": {
     "@chromatic-com/storybook": "1.6.1",