From 0135af8d677621274cddbdb39bed53050db2ac38 Mon Sep 17 00:00:00 2001
From: Xin Jin <39755499+EugeneJinXin@users.noreply.github.com>
Date: Wed, 9 Jul 2025 11:20:20 -0700
Subject: [PATCH] Potential fix for code scanning alert no. 44: DOM text
 reinterpreted as HTML

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 docs/overrides/main.html | 13 +++++--------
 docs/package.json        |  3 ++-
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/docs/overrides/main.html b/docs/overrides/main.html
index 5227fb8b7..4dabfa2ac 100644
--- a/docs/overrides/main.html
+++ b/docs/overrides/main.html
@@ -25,15 +25,12 @@ j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
         try {
             let rawContent = markdownScript.textContent;
             
-            // HTML entity decoding function
-            function decodeHtmlEntities(text) {
-                const tempDiv = document.createElement('div');
-                tempDiv.innerHTML = text;
-                return tempDiv.textContent || tempDiv.innerText || '';
-            }
+            // Import a library for decoding HTML entities
+            import { decode } from 'he';
+            
+            // Always decode HTML entities using a safe library
+            rawContent = decode(rawContent);
             
-            // Always decode HTML entities since the browser might encode them
-            rawContent = decodeHtmlEntities(rawContent);
             
             const data = JSON.parse(rawContent);
             const content = `# ${data.title}\n\nSource: ${window.location.href}\n\n${data.markdown}`;
diff --git a/docs/package.json b/docs/package.json
index 1a5908a84..abcdef39c 100644
--- a/docs/package.json
+++ b/docs/package.json
@@ -9,7 +9,8 @@
     "@langchain/core": "^0.3.38",
     "@langchain/openai": "^0.4.2",
     "msgpack-lite": "^0.1.26",
-    "nock": "^14.0.1"
+    "nock": "^14.0.1",
+    "he": "^1.2.0"
   },
   "devDependencies": {
     "@tsconfig/recommended": "^1.0.8",