From d58ce7b1b78f6590068ab93a93d04dfe80e914cc Mon Sep 17 00:00:00 2001
From: Nick Craig-Wood <nick@craig-wood.com>
Date: Wed, 8 Apr 2026 09:17:10 +0100
Subject: [PATCH] docs: fix XSS vulnerability in dropdown mobile header

Use textContent instead of innerHTML when inserting the dropdown
label to prevent DOM text being reinterpreted as HTML.

Fixes https://github.com/rclone/rclone/security/code-scanning/176
---
 docs/static/js/rclone.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/docs/static/js/rclone.js b/docs/static/js/rclone.js
index 72b8ba0cd..a15d49ca1 100644
--- a/docs/static/js/rclone.js
+++ b/docs/static/js/rclone.js
@@ -45,7 +45,13 @@
             // Mobile close header
             var header = document.createElement("div");
             header.className = "dropdown-mobile-header";
-            header.innerHTML = '<span>' + label + '</span><span class="dropdown-mobile-close">&times;</span>';
+            var labelSpan = document.createElement("span");
+            labelSpan.textContent = label;
+            var closeSpan = document.createElement("span");
+            closeSpan.className = "dropdown-mobile-close";
+            closeSpan.innerHTML = "&times;";
+            header.appendChild(labelSpan);
+            header.appendChild(closeSpan);
             menu.insertBefore(header, menu.firstChild);
             header.addEventListener("click", function() {
                 menu.classList.remove("show");