Two HIGH-severity CodeQL alerts in client-side JavaScript: DOM-based XSS via HTML string concatenation and an unvalidated URL redirect via window.location assignment.

related-modal.js — DOM XSS (js/xss-through-dom)

• Replaced unsafe HTML string concatenation passed to jQuery's $() constructor (which uses innerHTML) with explicit DOM API calls that set attributes directly, eliminating the XSS sink.

// Before — iframeName/iframeSrc flow into innerHTML
const iframeHTML = '<iframe id="related-modal-iframe" name="' + iframeName + '" src="' + iframeSrc + '"></iframe>';
const modalEl = $(modalHTML);

// After — attributes set via DOM API, no HTML parsing
const iframeEl = $('<iframe>').attr({ id: 'related-modal-iframe', name: iframeName, src: iframeSrc });
const modalEl = $('<div>').addClass('related-modal-iframe-container').append(iframeEl);

dropdown-filter.js — Unvalidated URL redirect (js/client-side-unvalidated-url-redirection)

• Added URL validation before window.location assignment to block javascript: and protocol-relative (//evil.com) URLs. Django admin filter values are always query strings (?...) or path-relative (/...), so this is lossless.

// Before
if (value) { window.location = value; }

// After
if (value && (value.startsWith('?') || (value.startsWith('/') && !value.startsWith('//')))) {
    window.location = value;
}

Checklist before requesting a review

• I have performed a self-review of my code.
• I have added tests for the proposed changes.
• I have run the tests and there are not errors.