Potential fix for code scanning alert no. 23: DOM text reinterpreted as HTML

[paule32]

Potential fix for https://github.com/paule32/HelpNDocTools/security/code-scanning/23

The safest fix is to ensure that any text extracted from the DOM and then set as HTML is properly escaped before insertion, so that it cannot be interpreted as executable code or markup. Rather than using tmp.html(_6b); _6b=tmp.text(); chains which encourage double-unescaping, we should avoid using .html() unless strictly necessary; using .text(_6b) (when setting text) avoids the vulnerability by always escaping strings. In this particular context, replace the use of .html() with .text(), both when setting and reading the tab titles. Thus, on line 515, replace tmp.html(_6b); with tmp.text(_6b);, which will safely insert plain text, and ensure that matching is done against text rather than potentially executable HTML. Only change lines involving setting the inner content of the element for comparison as indicated in the vulnerable block.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[chatgpt-codex-connector]

💡 Codex Review

HelpNDocTools/src/_internal/bootstrap/javascript/easyui/plugins/jquery.tabs.js

Lines 512 to 515 in 1de168d

	var p=_6d[i];
	tmp.html(p.panel("options").title);
	var _6e=tmp.text();
	tmp.text(_6b);

Still parses tab title as HTML

The patch aims to eliminate html() usage to avoid DOM text being interpreted as executable markup, but the loop still calls tmp.html(p.panel("options").title) before comparing titles. If any tab title is user-controlled HTML, jQuery will still parse and execute its contents (including <script> tags) even though the temporary span is detached. Only _6b is sanitized via text(), so the security risk described in the commit message remains for existing tab titles. Replacing the remaining html() invocation with text() is necessary to ensure the titles are treated as plain text.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".