Potential fix for code scanning alert no. 7: Cross-site scripting

[lgzarturo]

Potential fix for https://github.com/lgzarturo/springboot-course/security/code-scanning/7

To fix the problem, the user-controlled message parameter must not be written directly to the HTTP response without encoding. The usual mitigation is to apply contextual output encoding (HTML escaping in this case) before including it in the response body.

The best minimal change, consistent with the rest of the file, is:

• Use HtmlUtils.htmlEscape(message) to create a safe version of the input for inclusion in the response text.
• Continue to send the original message to Sentry, since Sentry accepts arbitrary strings and this does not affect XSS in the HTTP response.
• Update the returned string to use the escaped value instead of the raw message.

Concretely, in src/main/kotlin/com/lgzarturo/springbootcourse/sentry/adapters/rest/SentryController.kt, inside fun testMessage(...), introduce a new local variable, e.g. val safeMessage = HtmlUtils.htmlEscape(message), and change the return line to return "Message sent to Sentry: $safeMessage". No new imports are needed because HtmlUtils is already imported at line 15.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[lgzarturo]

Coverage Report

Overall Project	64.55% -0.25%	❌
Files changed	0%	❌

File	Coverage
SentryController.kt	1.28% -3.85%	❌