Potential fix for code scanning alert no. 8: Reflected server-side cross-site scripting

[BetterMint]

Potential fix for https://github.com/BetterMint/BetterMITM/security/code-scanning/8

General fix:
To prevent reflected XSS, any user input that is reflected in the response should be sanitized or escaped appropriately before rendering it into a page. In the context of Tornado and JSON responses, the risk is minimal, but to follow best practices, it's advisable to sanitize flow_id before reflecting it in the response.

Detailed best fix:
Since flow_id can be treated as a string (identifier), filter it for safety. You could escape it using Tornado's escaping utilities (e.g., tornado.escape.xhtml_escape or tornado.escape.json_encode). However, since the response is JSON, a better approach is to ensure (1) it's a string, and (2) the response is always sent as JSON with the correct Content-Type. You should also defensively check or coerce flow_id to a safe representation.

Changes required:

• In FlowStateControl.get, ensure flow_id is safely encoded/escaped before it is reflected.
• Use tornado.escape.json_encode(str(flow_id)) for the value sent or, better, validate and sanitize flow_id (e.g., allow only alphanumeric and a few safe characters).
• Imports: No new imports are needed; tornado.escape is already imported.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.