security(ui): escape perf dashboard values (raw slow-query path) in perf.js #392

Found during the review of #373 (#333, merged as 8a26a339). It is a follow-up to the #333 XSS work and was deliberately kept out of #373's scope.

Problem

public/perf.js (around lines 324, 334 and 345) interpolates perf data into HTML without escaping. One of those values is SlowQuery.Path, which is set to the raw r.URL.Path with no normalisation (cmd/server/routes.go ~509). By contrast, the endpoint key a few lines above is normalised to the mux route template.

Verified in a browser [T]: injecting a hostile endpoint key and slow-query path into the /api/perf response renders injected <img> elements on #/perf, and onerror fires.

Exploitability (narrower than the raw sink suggests)

To be recorded, a request must route under /api/ and take longer than 100 ms. Five hostile /api/... paths sent to a local server all returned 404 quickly. The recorded key collapsed to /api/, and no hostile key or slow query was stored. No end-to-end exploit was demonstrated, but this should not rely on timing.

Required work

• Escape every interpolated perf value in public/perf.js. Use escapeHtml for text and escapeAttr for attributes, or textContent.
• Consider normalising SlowQuery.Path server-side, for example to the route template plus a truncated, sanitised raw path.
• Add hostile-string unit/E2E tests for the perf dashboard, and run them only against a local server.
• Make sure scripts/check-xss-sinks.sh covers these sinks.