Fix: prevent XSS in createModal by building modal via DOM APIs (avoid…

[rabail-aamir]

Description

Fixes a cross-site scripting (XSS) vulnerability in the modal helper. The modal was previously constructed
using string templates and innerHTML, which allowed injected HTML (for example <script> tags or
onerror attributes) to execute. This change refactors the modal to build its DOM using the existing
elem() helper and document.createTextNode, so user-supplied strings are inserted as plain text and
cannot execute as HTML.

Files changed:

• javascript/UI/modal.js — refactored to remove innerHTML and build modal via DOM APIs.

Motivation and context:
Using innerHTML with untrusted input opened the app to XSS when titles or content included malicious
markup. The refactor eliminates that attack vector while preserving the modal API. If callers require
rich HTML rendering, they should sanitize input first (e.g. DOMPurify) and pass a trusted DOM node.

Dependencies:

• No new runtime dependencies were added. (If sanitized HTML is later required, consider adding DOMPurify.)

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation (update or new)

How Has This Been Tested?

Manual testing on the local development server (npm run server) at http://localhost:8000.
Verification performed by creating modals with safe strings and with known malicious payloads; observed that
malicious markup is rendered as inert text and no injected scripts or event handlers executed.

Before test

After test

Testing Checklist

• Tested in latest Chrome (manual)
• Tested in latest Safari (manual)
• Tested in latest Firefox

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code in hard-to-understand areas
• I have made corresponding changes to the documentation (if required)
• My changes generate no new warnings
• I have requested a review from ... on the Pull Request

[Oliver-Quail]

Hi @rabail-aamir,
Great PR. I tested and see that it works
I approve this PR