Escape API id inside embed iframe snippet

[greatest0fallt1me]

Summary

EmbedPreview.generateSnippet interpolates apiId directly into the iframe src URL and title attribute. An id containing quotes or '&' yields broken or injectable HTML that users paste into their own sites.

Why this matters

The snippet is copied into third-party pages; attribute injection there becomes a stored XSS vector on the embedding site.

Scope

encodeURIComponent the id in the URL and HTML-escape it in the title attribute; add tests with quotes and angle brackets.

Relevant code in CalloraOrg/Callora-Frontend:

• src/components/EmbedPreview.tsx

Priority

Medium

Acceptance criteria

• The src URL uses an encoded id
• The title attribute escapes quotes and angle brackets
• Normal ids render unchanged
• EmbedPreview tests cover hostile ids

Validation

npm test -- --run src/components/EmbedPreview.test.tsx

Non-goals

• Typo-only, formatting-only, or cosmetic changes.
• Unrelated refactors, dependency upgrades, or broad rewrites.
• Removing safeguards or weakening validation to make tests pass.

Contributor application

Before coding, describe the affected modules, proposed state/invariant changes, test strategy, compatibility considerations, and an estimate. Wait for assignment before starting implementation.

PR requirements

Use a feature branch and include Closes #<issue-number>. Address every criterion, map criteria to code and tests, explain security and failure-mode handling, and ensure CI passes.

Quality review

A maintainer will assess correctness, completeness, test depth, compatibility, observability, and adverse-case handling. A substantive implementation is required; merge or CI status alone does not guarantee reward eligibility.

---

Generated by Claude Code

[sheyman546]

@sheyman546 has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

PLEASE I WILL LOVE ABOUT THIS ISSUE

ℹ️ Repo Maintainers: To accept this application, review their application or assign @sheyman546 to this issue.

[thisismizz]

@thisismizz has applied to work on this issue as part of the Stellar Wave Program's 9th wave.

Hi maintainer, I can fix this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @thisismizz to this issue.

[drips-wave]

Congratulations, @thisismizz! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on September 30, 2026.

🧑‍💻 @thisismizz: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊