Fix XSS vulnerability in PATH environment variable rendering

[Copilot]

Addressed XSS vulnerability where Html.Raw() was rendering user-controllable environment variable data without encoding.

Changes

• Encode before replace: Wrapped PATH environment variable with Html.Encode() before delimiter replacement in PlaceholderValues.cshtml

// Before
@Html.Raw(Model.ResolvedFromPathEnvironmentVariable?.Replace(";", "<br/>"))

// After  
@Html.Raw(Html.Encode(Model.ResolvedFromPathEnvironmentVariable).Replace(";", "<br/>"))

This ensures HTML entities are escaped before rendering while preserving intended <br/> line breaks. The null-conditional operator (?.) is not needed since Html.Encode() handles null values by returning an empty string.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• 2wrvsblobprodwus2180.blob.core.windows.net
  • Triggering command: /usr/bin/dotnet dotnet build (dns block)
• 84hvsblobprodwus2148.blob.core.windows.net
  • Triggering command: /usr/bin/dotnet dotnet build (dns block)
• 8yfvsblobprodwus2171.blob.core.windows.net
  • Triggering command: /usr/bin/dotnet dotnet build (dns block)
• b5svsblobprodwus2116.blob.core.windows.net
  • Triggering command: /usr/bin/dotnet dotnet build (dns block)
• hd3vsblobprodwus2117.blob.core.windows.net
  • Triggering command: /usr/bin/dotnet dotnet build (dns block)
• n6wvsblobprodwus2123.blob.core.windows.net
  • Triggering command: /usr/bin/dotnet dotnet build (dns block)
• vm9vsblobprodwus2190.blob.core.windows.net
  • Triggering command: /usr/bin/dotnet dotnet build (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[bart-vmware]

Please take these suggestions. The ?. is no longer needed.

[Copilot]

Please take these suggestions. The ?. is no longer needed.

Applied in commit 74f31e7. Removed the unnecessary ?. operator from both lines since Html.Encode() handles null values by returning an empty string.