Fix unsafe innerHTML usage

ParticleCore · Feb 3, 2024 · f8a91c5 · f8a91c5
1 parent 0cd8b3f
commit f8a91c5
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/src/js/options.js b/src/js/options.js
@@ -467,11 +467,13 @@ const Manager = {
                 child.dataset.handle = newList[item].handle;
                 child.dataset.ucid = item;
                 child.innerHTML = `
-                    <div class="channelName">${newList[item].name || "<i>@" + newList[item].handle + "</i>"}</div>
+                    <div class="channelName"></div>
                     <svg class="remove" xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 -960 960 960" width="24">
                         <path d="M280-120q-33 0-56.5-23.5T200-200v-520h-40v-80h200v-40h240v40h200v80h-40v520q0 33-23.5 56.5T680-120H280Zm400-600H280v520h400v-520ZM360-280h80v-360h-80v360Zm160 0h80v-360h-80v360ZM280-720v520-520Z"/>
                     </svg>`;
 
+                child.querySelector(".channelName").textContent = newList[item].name || "<i>@" + newList[item].handle + "</i>";
+
                 newNodeList.push(child);
 
             });