fix: add output encoding in device.js

[anupamme]

Summary

Fix high severity security issue in website/src/js/device.js.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	website/src/js/device.js:63
Assessment	Likely exploitable
CWE	CWE-79

Description: The application dynamically fetches and executes JavaScript codec files based on user-configurable filenames without server-side validation. An attacker who can manipulate the filename (e.g., via XSS or compromised CDN) or perform a MITM attack could cause arbitrary malicious code to execute in the user's browser context.

Evidence

Exploitation scenario: Attackers can compromise the codec file source (via MITM on HTTP, CDN compromise, or XSS to modify window.config.device) to inject malicious JavaScript that gets fetched and executed by the.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• website/src/js/device.js

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[CLAassistant]

All committers have signed the CLA.