[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_169":170,"_171":172},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_128":-5,"_20":129,"_22":130,"_131":132,"_133":134,"_25":135,"_24":-5,"_136":-5,"_137":-5,"_138":54,"_139":140,"_141":45,"_142":-5,"_143":-5,"_144":145},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","test0","name","xss-scanner","branchName","main","version","path","","project",{"_34":74,"_13":14,"_46":75,"_76":-5,"_77":54,"_78":79,"_80":79,"_81":82,"_83":-5,"_84":85,"_86":59,"_87":45,"_88":-5,"_89":-5,"_90":48,"_91":92,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":98,"_99":98,"_100":101,"_102":101,"_103":101,"_104":98,"_105":98,"_106":107,"_108":109,"_110":111,"_112":54},"tree",[65,66],"file","contents",[32,33],"upstream","pull","ahead","behind","envVars",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":62,"_49":50,"_51":63,"_53":54,"_55":-5,"_18":64},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_18":56},"id","eb6eaa28-51de-11f1-b52e-ee650bb23af1","vulnerable.tsx","fileId","eb6eaac8-51de-11f1-b52e-ee650bb23af1","parentId","branchId","85537994-51de-11f1-804c-ee650bb23af1","branchVersion",2,"latest",true,"createdAt",["D",1779015329961],0,"fileType","http","content","// Intentionally vulnerable endpoint for testing the XSS scanner\n// ⚠️ DO NOT use this pattern in production code!\nexport default async function(req: Request): Promise {\n const url = new URL(req.url);\n const q = url.searchParams.get(\"q\") ?? \"\";\n\n // Intentionally reflecting user input without sanitization\n const html = `\n\n\n Vulnerable Test Page\n \n\n\n

🎯 Vulnerable Test Page

This page intentionally reflects input without sanitization.

You searched for:

${q}

\n \n

⚠️ This page is intentionally vulnerable for educational testing only.

\n\n`;\n\n return new Response(html, { headers: { \"content-type\": \"text/html\" } });\n}\n","deleted",false,"label",[36],"f9f41a88-51de-11f1-9d2c-ee650bb23af1","main.tsx","9abfdd7c-51de-11f1-9272-ee650bb23af1",3,["D",1779015354318],1,"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { renderToString } from \"https://esm.sh/react-dom@18.2.0/server\";\nimport { parseVal } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst XSS_PAYLOADS = [\n ``,\n `

`,\n ``,\n `

Code