Potential fix for code scanning alert no. 23: Exception text reinterpreted as HTML

[Tanker187]

Potential fix for https://github.com/Tanker187/vite/security/code-scanning/23

In general, to fix this issue you should avoid sending raw exception messages or stack traces directly to an HTML response. Instead, either (1) send a generic, constant error message to the client and log detailed information on the server, or (2) if detailed information must be shown, ensure it is properly escaped and sent as text, not HTML.

The best fix here, without changing existing functionality too much, is to stop sending e.stack back to the browser and instead send a generic error message (e.g. "Internal Server Error") while keeping the detailed error logged server-side. This preserves current logging behavior (console.log(e.stack)) and therefore debuggability, but removes the XSS vector. Concretely, in playground/ssr-pug/server.js, in the catch block of the app.use('*all', ...) handler, replace res.status(500).end(e.stack) with res.status(500).end('Internal Server Error') (or similar static text). No extra imports or helpers are needed.

Change details:

• File: playground/ssr-pug/server.js
• Region: the catch (e) { ... } block around lines 59–63.
• Modification: remove use of e.stack in the HTTP response and return a constant error message instead.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.