Potential fix for code scanning alert no. 2: DOM text reinterpreted as HTML

[krokosik]

Potential fix for https://github.com/oss-apps/split-pro/security/code-scanning/2

Use safe URL/query construction instead of manual string interpolation.
Best fix: build the redirect with URLSearchParams (or URL) so each dynamic value is encoded contextually and cannot break query boundaries.

In src/pages/auth/VerificationStep.tsx, update onOTPSubmit (lines 35–44 region):

• Read otp once from the form.
• Create const params = new URLSearchParams({ email, token: otp }).
• If callbackUrl exists, append it using params.append('callbackUrl', callbackUrl).
• Set window.location.href to `/api/auth/callback/email?${params.toString()}`.

This preserves behavior while removing unsafe concatenation and encoding all untrusted data properly.
No new imports are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 66cedd3f-5cf5-47e9-9923-d87cbf41a88f

📥 Commits

Reviewing files that changed from the base of the PR and between c5066e1 and b54a7ac.

📒 Files selected for processing: 1

• src/pages/auth/VerificationStep.tsx

+----------------------------------------------------------+
| Solving problems you didn't know you were about to have. |
+----------------------------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}