From 3cbead1219694982f9ae9f74872b25c7391d23a0 Mon Sep 17 00:00:00 2001
From: water <672684719@qq.com>
Date: Wed, 22 Jul 2026 00:28:44 +0800
Subject: [PATCH] fix: replace innerHTML with DOM node construction to prevent
 XSS (Closes #7137)

---
 tools/bcos-badge-generator/index.html | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/tools/bcos-badge-generator/index.html b/tools/bcos-badge-generator/index.html
index f11d8bb0e..1b31f6a8f 100644
--- a/tools/bcos-badge-generator/index.html
+++ b/tools/bcos-badge-generator/index.html
@@ -732,14 +732,14 @@ <h1>BCOS Badge Generator</h1>
         img.alt = `BCOS Badge for ${certId}`;
 
         img.onload = () => {
-          previewArea.innerHTML = '';
+          previewArea.replaceChildren();
           previewArea.appendChild(img);
           resolve();
         };
 
         img.onerror = () => {
           // For demo purposes, show a placeholder if endpoint is unavailable
-          previewArea.innerHTML = '';
+          previewArea.replaceChildren();
           const container = document.createElement('div');
           container.style.textAlign = 'left';
 
@@ -808,7 +808,11 @@ <h1>BCOS Badge Generator</h1>
     function setLoading(loading) {
       if (loading) {
         generateBtn.disabled = true;
-        generateBtn.innerHTML = '<span class="spinner"></span>Generating...';
+        generateBtn.replaceChildren();
+        const spinner = document.createElement('span');
+        spinner.className = 'spinner';
+        generateBtn.appendChild(spinner);
+        generateBtn.appendChild(document.createTextNode('Generating...'));
       } else {
         generateBtn.disabled = false;
         generateBtn.textContent = 'Generate Badge';
@@ -821,7 +825,7 @@ <h1>BCOS Badge Generator</h1>
       currentStyle = 'flat';
       styleBtns.forEach(b => b.classList.remove('active'));
       styleBtns[0].classList.add('active');
-      previewArea.innerHTML = '';
+      previewArea.replaceChildren();
       const span = document.createElement('span');
       span.className = 'preview-placeholder';
       span.textContent = 'Enter a Certificate ID and click "Generate Preview" to see your badge';