feat: Modernize project with Vite and modular structure

[google-labs-jules]

This refactoring modernizes the XMOJ-Script project by introducing Vite as a bundler, modularizing the codebase, and adopting a standard project structure. It also includes updates to the CI/CD workflow and dependency management.

General Approach:

• Do not pass potentially attacker-controlled or unsanitized DOM text directly into .innerHTML.
• Instead, either (a) set safe text using the .innerText or .textContent property, or (b) escape any special HTML characters before assigning to .innerHTML.

Detailed Best Fix:

• On line 189, change the assignment from AutoCheatButton.innerHTML = "正在提交 " + PID; to using AutoCheatButton.innerText = "正在提交 " + PID;.
  • This completely avoids HTML interpretation, so even if PID contains malicious code or markup, it is printed as plain text.
  • Existing functionality (displaying the loading message) is preserved.

File/Lines to Change:

• Only one line needs to be changed: in src/pages/contest.js, update line 189.

Implementation Needs:

• No new imports or extra functions are required, just change .innerHTML to .innerText.

---

To fix this DOM-based XSS vulnerability, all direct insertions of untrusted Username data into HTML markup should be properly escaped or replaced with safe alternatives. When concatenating user data (such as Username) into HTML attribute values (e.g., within <a href=...>), the value must be HTML-escaped to prevent breaking out of attributes or tags. Similarly, any use of user data within inline CSS or within badge contents should also be encoded/sanitized if not controlled.

Specifically, within GetUsernameHTML in src/utils.js, we should:

1. Use the provided escapeHTML function to encode Username before inserting it into the href attribute and elsewhere in the markup string.
2. Optionally, also encode other possibly user-controllable strings (such as colors in <span style>, although if these are only from trusted badge data this may not be necessary).
3. Replace all ${Username} interpolations within markup strings with ${escapeHTML(Username)}.

No new dependencies are needed, as the existing escapeHTML implementation suffices.

---

To address the vulnerability, we need to ensure untrusted input (Username) is properly escaped before inclusion as HTML. The best fix is to apply the escapeHTML utility function to Username whenever it is interpolated into HTML markup destined for innerHTML. Specifically, in GetUsernameHTML, this affects the anchor href attribute and elsewhere Username is embedded directly in markup. Since attribute contexts (href) should not be vulnerable to tag-breaking if properly escaped (with escapeHTML), the fix will replace e.g. ${Username} in any HTML string construction for innerHTML with ${escapeHTML(Username)}.

Required changes:

• Update GetUsernameHTML in src/utils.js.
• Use escapeHTML for all interpolations of Username inside HTML assigned via innerHTML.
• Ensure the fix does not alter usages where data is added as a text node (already safe).

Method/imports needed:
No imports required—escapeHTML is already defined in the same file.

---