Potential fix for code scanning alert no. 45: DOM text reinterpreted as HTML

[paule32]

Potential fix for https://github.com/paule32/HelpNDocTools/security/code-scanning/45

General fix:
To eliminate this DOM text–to–HTML reinterpreting risk, do not assign text content from a DOM node (via .text()) to HTML content directly (via .html()). If you must set the HTML, ensure the value is properly HTML-encoded or, better, set it as text using .text() so that jQuery will encode any potentially dangerous characters.

Specific fix:
In the function _65, instead of writing tmp.html(_6b) (where _6b could be derived from previously-extracted DOM text), use tmp.text(_6b). This way, any HTML in _6b will be properly escaped (treated as text), and there is no risk of unescaped HTML injection or XSS. This does not change the logic of the code as used here (since the purpose seems to be normalizing text).

What/where to change:

• In src/__pycache__/_internal/bootstrap/js/easyui/plugins/jquery.tabs.js
• Replace tmp.html(_6b); (line 515) with tmp.text(_6b);
• No new imports or methods are required.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.