From c104904b260eb44decc14b13bb4954c38b10c4a5 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 16:36:15 +0000
Subject: [PATCH 1/2] Initial plan


From 574a5a83b2d9ab5083042825049adc574cd2bef9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 16:38:40 +0000
Subject: [PATCH 2/2] Fix XSS (js/xss-through-dom): replace innerHTML with safe
 DOM APIs in methoddriven4.html

---
 .../paper2poster/assets/layouts/methoddriven4.html   | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/ResearchStudio-Reel/skills/paper2poster/assets/layouts/methoddriven4.html b/ResearchStudio-Reel/skills/paper2poster/assets/layouts/methoddriven4.html
index fa227a1..dea6a4c 100644
--- a/ResearchStudio-Reel/skills/paper2poster/assets/layouts/methoddriven4.html
+++ b/ResearchStudio-Reel/skills/paper2poster/assets/layouts/methoddriven4.html
@@ -1553,21 +1553,25 @@ <h2>Takeaway <button class="listen-btn" data-section="takeaway">Listen</button><
       Array.from(sec.children).forEach(walk2);
       const badge = document.createElement("div");
       badge.className = "dbg-badge dbg-section";
-      let html = `${id}  ${Math.round(actual)}px`;
+      let txt = `${id}  ${Math.round(actual)}px`;
       if (hasContent && actual > 0) {
         const fullRatio = ((cb - secRect.top) / sc) / actual;
         // Verdict label lives on the content bbox below — keep the
         // per-section badge compact.
-        html += `  ratio=${(fullRatio * 100).toFixed(1)}%`;
+        txt += `  ratio=${(fullRatio * 100).toFixed(1)}%`;
       }
+      badge.textContent = txt;
       if (estimates && estimates[id] != null) {
         const est = estimates[id];
         const delta = Math.round(actual - est);
         const cls = delta >= 0 ? "dbg-delta-pos" : "dbg-delta-neg";
         const sign = delta >= 0 ? "+" : "";
-        html += ` <span class="${cls}">est=${est} Δ${sign}${delta}</span>`;
+        const span = document.createElement("span");
+        span.className = cls;
+        span.textContent = `est=${est} Δ${sign}${delta}`;
+        badge.appendChild(document.createTextNode(" "));
+        badge.appendChild(span);
       }
-      badge.innerHTML = html;
       sec.appendChild(badge);
     });
     stampBboxes();