From 206d83194164b0984d9b574977ae016baaf80143 Mon Sep 17 00:00:00 2001
From: potato-pancake-png <yurizoa12369@gmail.com>
Date: Fri, 2 Oct 2026 13:06:38 +0900
Subject: [PATCH] Fix stored XSS in received packet rendering

---
 data_embed/script.js | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/data_embed/script.js b/data_embed/script.js
index db48f8a..a4a90ae 100644
--- a/data_embed/script.js
+++ b/data_embed/script.js
@@ -606,13 +606,11 @@ function loadReceivedPackets(packets) {
         packets.forEach((packet) => {
             const element = document.createElement("tr");
 
-            element.innerHTML = `
-                        <td>${packet.rxDate}</td>
-                        <td>${packet.rxTime}</td>
-                        <td>${packet.packet}</td>
-                        <td>${packet.RSSI}</td>
-                        <td>${packet.SNR}</td>
-                    `;
+            ['rxDate', 'rxTime', 'packet', 'RSSI', 'SNR'].forEach((field) => {
+                const cell = document.createElement("td");
+                cell.textContent = String(packet[field]);
+                element.appendChild(cell);
+            });
 
             container.appendChild(element);
         })
@@ -1172,4 +1170,4 @@ form.addEventListener("invalid", function (event) {
             el.scrollIntoView({ block: "center", behavior: "smooth" });
         }, 0);
     }
-}, true);
\ No newline at end of file
+}, true);