From 855fc9c9c85720b5e0c6b9086083165492e2a864 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Thu, 16 Jul 2026 17:15:54 +0200
Subject: Construct DOM elements using escaping helpers to prevent XSS

---
 public/javascripts/related_assets.js | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

(limited to 'public/javascripts/related_assets.js')

diff --git a/public/javascripts/related_assets.js b/public/javascripts/related_assets.js
index 803332f2..3340fa79 100644
--- a/public/javascripts/related_assets.js
+++ b/public/javascripts/related_assets.js
@@ -15,12 +15,9 @@ related_assets = {
       renderResults: function(data, results) {
         var found = false;
         data.forEach(function(asset) {
-          var item = $(
-            "<a href='#' class='related_asset_result'>" +
-              "<img src='" + asset.thumb_url + "' alt=''>" +
-              "<span>" + asset.name + "</span>" +
-            "</a>"
-          );
+          var item = $("<a>", { href: "#", "class": "related_asset_result" });
+          item.append($("<img>", { src: asset.thumb_url, alt: "" }));
+          item.append($("<span>").text(asset.name || ""));
           item.bind("click", function() {
             related_assets.attach(asset.id, createUrl, list);
             return false;
-- 
cgit v1.3