Removed DOMXSS vulnerability noticed by Kodiak

adobecom · May 29, 2024 · 45981f5 · 45981f5
1 parent 29d0a16
commit 45981f5
Showing 1 changed file with 11 additions and 3 deletions.
diff --git a/libs/features/personalization/preview.js b/libs/features/personalization/preview.js
@@ -254,10 +254,18 @@ function createPreviewPill(manifests) {
           </div>
         </div>
       </div>
-    </div>
-    <div class="dark">
-      <a class="con-button outline button-l" href="${simulateHref.href}" title="Preview above choices">Preview</a>
     </div>`;
+
+  const darkDiv = document.createElement('div')
+  const button = document.createElement('a')
+  darkDiv.className = 'dark'
+  button.className = 'con-button outline button-l'
+  button.title = 'Preview above choices'
+  button.text = 'Preview'
+  button.href = simulateHref.href
+  darkDiv.append(button)
+  div.append(darkDiv)
+
   overlay.append(div);
   addPillEventListeners(div);
 }