fix: replace innerHTML with textContent to prevent DOM XSS [FaaFyfxR9WAQrL7FcAgEHJvztd8cVMxvjHRS55rw1nwH]

[waterWang]

Summary

Replaces all 4 occurrences of result.innerHTML = "" with result.textContent = "" in faucet_service.py.

Problem

The faucet service JavaScript code uses result.innerHTML = "" to clear a <div> before appending new DOM nodes. While the actual dynamic content is safely set via textContent and createTextNode (which are not vulnerable to XSS), using innerHTML for the reset is inconsistent with the security pattern used elsewhere and could be a maintenance risk if future code adds user-controlled content to the innerHTML assignment.

Fix

Replaced all 4 occurrences of result.innerHTML = "" with result.textContent = "" (lines 1598, 1614, 1630, 1643). This is more consistent with the rest of the codebase which already uses secure DOM manipulation methods (textContent, createTextNode, appendChild).

Closes #7160

[github-actions]

Welcome to RustChain! Thanks for your first pull request.

Before we review, please make sure:

• Non-doc PRs have a BCOS-L1 or BCOS-L2 label
• Doc-only PRs are exempt from BCOS tier labels when they only touch docs/**, *.md, or common image/PDF files
• New code files include an SPDX license header
• You've tested your changes against the live node

Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150)

A maintainer will review your PR soon. Thanks for contributing!

[github-actions]

RTC Reward

This merged PR earned 5 RTC — sent to waterWang.

RustChain Bounty Program