Merge pull request #34 from IanSkelskey/alert-autofix-12

Potential fix for code scanning alert no. 12: DOM text reinterpreted as HTML
IanSkelskey · Feb 23, 2025 · 50ef0e4 · 50ef0e4
2 parents fb966f5 + cf98e48
commit 50ef0e4
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/Open-ILS/src/extras/opensearchportal.html b/Open-ILS/src/extras/opensearchportal.html
@@ -160,7 +160,12 @@
 			if (cur_src.childNodes[i].nodeValue == turi)
 				return;
 		}
-		cur_src.innerHTML += '<a name="' + single_source + '" href="' + turi + '">' + turi + '</a><br>';
+		var a = document.createElement('a');
+		a.name = single_source;
+		a.href = turi;
+		a.textContent = turi;
+		cur_src.appendChild(a);
+		cur_src.appendChild(document.createElement('br'));
 		perform_search(single_source);
 		return;
 	}