Potential fix for code scanning alert no. 2230: DOM text reinterpreted as HTML

Trial for Copilot's fix

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

superset-frontend/src/utils/getBootstrapData.ts

@@ -36,7 +36,26 @@ export default function getBootstrapData(): BootstrapData {
 const normalizePathWithFallback = (
   path: string | undefined,
   fallback: string,
-): string => (path ?? fallback).replace(/\/$/, '');
+): string => {
+  const normalize = (value: string): string | null => {
+    const trimmed = value.trim();
+    if (!trimmed) {
+      return null;
+    }
+    // Only allow root-relative paths. Reject absolute/protocol-relative URLs.
+    if (/^[a-z][a-z0-9+.-]*:/i.test(trimmed) || trimmed.startsWith('//')) {
+      return null;
+    }
+    const withLeadingSlash = trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
+    const collapsed = withLeadingSlash.replace(/\/{2,}/g, '/');
+    if (collapsed === '/') {
+      return '/';
+    }
+    return collapsed.replace(/\/$/, '');
+  };
+
+  return normalize(path ?? '') ?? normalize(fallback) ?? '/';
+};
 
 const APPLICATION_ROOT_NO_TRAILING_SLASH = normalizePathWithFallback(
   getBootstrapData().common.application_root,