fix: sanitize dynamic innerHTML in templates (#47)

2026-03-14 15:06:31 -04:00
parent bb287b2c73
commit 591954891a
2 changed files with 11 additions and 4 deletions
--- a/src/dashboard/templates/base.html
+++ b/src/dashboard/templates/base.html
@@ -327,7 +327,11 @@
        .then(function(data) {
          var list = document.getElementById('notif-list');
          if (!data.length) {
-            list.innerHTML = '<div class="mc-notif-empty">No recent notifications</div>';
+            list.innerHTML = '';
+            var emptyDiv = document.createElement('div');
+            emptyDiv.className = 'mc-notif-empty';
+            emptyDiv.textContent = 'No recent notifications';
+            list.appendChild(emptyDiv);
            return;
          }
          list.innerHTML = '';