mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-19 09:06:14 +00:00
Tobias GesellchenandClaude Opus 4.7
9ce42f3965
Sweeps the remaining instances of the same pattern that triggered CodeQL alert 132 in PR #240's review: status messages built by string-concatenating the user-controlled `display` (device name) into `.innerHTML`. None of these had ever needed HTML formatting; they're all plain status text. Converts 26 sites across reboot(), revert(), migrate(), showSummary(), trustCA(), ensureRemoteServices(), removeRemoteServices(), backup(), plus fetchDevices' error fallback and the loadAccount sync log line. The one site that genuinely needs intentional <strong> formatting — the migrate() success message ("Please reboot the device to activate the changes.") — is rebuilt with replaceChildren + createElement so the device name still flows through createTextNode rather than HTML parsing. Out of scope (intentionally left for a separate pass): the dashboard table rows, account-metadata templates, and the error.message-into- colored-span / redirectUrl-into-href patterns. Those are different classes and benefit from a focused refactor. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>