From b54a7acd26eb8f7fe6b362239a1dd3b9f42f5bd1 Mon Sep 17 00:00:00 2001
From: Wiktor Krokosz <38408316+krokosik@users.noreply.github.com>
Date: Thu, 15 Oct 2026 23:33:10 +0200
Subject: [PATCH] Potential fix for code scanning alert no. 2: DOM text
 reinterpreted as HTML

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 src/pages/auth/VerificationStep.tsx | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/pages/auth/VerificationStep.tsx b/src/pages/auth/VerificationStep.tsx
index f9d34c983..8172e7be1 100644
--- a/src/pages/auth/VerificationStep.tsx
+++ b/src/pages/auth/VerificationStep.tsx
@@ -38,9 +38,17 @@ const VerificationStep: FC<VerificationStepProps> = ({ feedbackEmail, email, cal
       return;
     }
 
-    window.location.href = `/api/auth/callback/email?email=${encodeURIComponent(
+    const otp = otpForm.getValues().otp;
+    const params = new URLSearchParams({
       email,
-    )}&token=${otpForm.getValues().otp}${callbackUrl ? `&callbackUrl=${callbackUrl}` : ''}`;
+      token: otp,
+    });
+
+    if (callbackUrl) {
+      params.append('callbackUrl', callbackUrl);
+    }
+
+    window.location.href = `/api/auth/callback/email?${params.toString()}`;
   }, [email, otpForm, callbackUrl, t]);
 
   const feedbackEmailLink = useMemo(() => `mailto:${feedbackEmail}`, [feedbackEmail]);