From 13ff96db85b924e4890d384f6cc60601394b6ea3 Mon Sep 17 00:00:00 2001
From: Huang Xin <chrox.huang@gmail.com>
Date: Thu, 9 Apr 2026 12:10:49 +0800
Subject: [PATCH] security: potential fix for code scanning alert no. 19: DOM
 text reinterpreted as HTML (#3802)

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 apps/readest-app/src/utils/highlightjs.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/readest-app/src/utils/highlightjs.ts b/apps/readest-app/src/utils/highlightjs.ts
index 56cd5052..0caf4c01 100644
--- a/apps/readest-app/src/utils/highlightjs.ts
+++ b/apps/readest-app/src/utils/highlightjs.ts
@@ -58,7 +58,7 @@ export const manageSyntaxHighlighting = (doc: Document, viewSettings: ViewSettin
     if (styleElement) styleElement.remove();
     doc.querySelectorAll('pre').forEach((block) => {
       if ((block as HTMLElement).dataset['highlighted']) {
-        block.innerHTML = block.textContent || '';
+        block.textContent = block.textContent || '';
       }
     });
     return;
@@ -78,7 +78,7 @@ export const manageSyntaxHighlighting = (doc: Document, viewSettings: ViewSettin
 
   codeBlocks.forEach((block) => {
     // remove any previously applied classes by hljs
-    block.innerHTML = block.textContent || '';
+    block.textContent = block.textContent || '';
     block.className = block.className.replace(/language-\S+/g, '');
     block.classList.remove('hljs');
     block.removeAttribute('data-highlighted');