Fix indexer demo DOM XSS

[kalepail]

Summary

• Encode untrusted indexer metadata before HTML rendering.
• Protect text and quoted attribute contexts.
• Add a Content Security Policy for inline script protection.
• Add regression tests and CI coverage for the indexer demo.

Verification

• pnpm --filter indexer-demo test
• pnpm --filter indexer-demo build
• pnpm test --run
• Live Chromium replay created zero injected elements.
• All seven exploit markers remained zero.

[Copilot]

Pull request overview

Hardens the indexer demo against DOM XSS from untrusted metadata.

Changes:

• Escapes dynamic HTML text and attribute values.
• Adds CSP protection and escape regression tests.
• Adds demo test/build coverage to CI.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
indexer/demo/src/main.ts	Escapes indexer metadata before rendering.
indexer/demo/src/html.ts	Adds HTML escaping utility.
indexer/demo/src/html.test.ts	Tests escaping behavior and payloads.
indexer/demo/index.html	Adds Content Security Policy.
indexer/demo/package.json	Adds Vitest and test script.
pnpm-lock.yaml	Locks the Vitest dependency.
.github/workflows/ci.yml	Runs indexer demo tests and build.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.