fix: remove escapeHtml() from textContent assignment on view label
textContent is inherently XSS-safe and does not interpret HTML entities. Wrapping with escapeHtml() caused literal entity strings (e.g., &) to display instead of the intended characters (e.g., &) for view names containing special characters like &, <, or >. Generated with Amplifier Co-Authored-By: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com>
This commit is contained in:
@@ -859,7 +859,7 @@ function renderViewDropdown() {
|
||||
} else if (_activeView === 'hidden') {
|
||||
label.textContent = 'Hidden';
|
||||
} else {
|
||||
label.textContent = escapeHtml(_activeView);
|
||||
label.textContent = _activeView;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user