From e7624a08c6a9d7ad615e8d9e9790ee2c3c88a8b6 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 24 Mar 2026 12:43:32 +0000
Subject: [PATCH] fix: replace inline onclick with addEventListener to prevent
 XSS (CodeQL js/incomplete-sanitization)

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/f22ed4e7-70d7-426e-ac6d-63925ec2b843
---
 docs/index.html | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/docs/index.html b/docs/index.html
index 03869da2..92bf1ee0 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -1844,8 +1844,21 @@ function enhanceExecBlocks(bblEl) {
 
       const actionsDiv = document.createElement('div');
       actionsDiv.className = 'exec-card-actions';
-      actionsDiv.innerHTML = '<button class="exec-btn exec-btn-copy" onclick="copyExecBlock(this)">📋 复制指令</button>'
-        + '<button class="exec-btn exec-btn-submit" onclick="submitExecBlock(this,\'' + esc(instrId).replace(/'/g, "\\'") + '\',\'' + esc(modName).replace(/'/g, "\\'") + '\')">🚀 @铸渊执行</button>';
+
+      const copyBtn = document.createElement('button');
+      copyBtn.className = 'exec-btn exec-btn-copy';
+      copyBtn.textContent = '📋 复制指令';
+      copyBtn.addEventListener('click', function() { copyExecBlock(this); });
+
+      const submitBtn = document.createElement('button');
+      submitBtn.className = 'exec-btn exec-btn-submit';
+      submitBtn.textContent = '🚀 @铸渊执行';
+      submitBtn.dataset.instrId = instrId;
+      submitBtn.dataset.modName = modName;
+      submitBtn.addEventListener('click', function() { submitExecBlock(this, this.dataset.instrId, this.dataset.modName); });
+
+      actionsDiv.appendChild(copyBtn);
+      actionsDiv.appendChild(submitBtn);
       pre.style.position = 'relative';
       pre.appendChild(actionsDiv);
     }