js_forbidden_html

innerHTML, outerHTML, srcdoc, insertAdjacentHTML, createContextualFragment, DOMParser and document.write are not allowed: they turn text into HTML.

• Severity: Error: it blocks publishing the version.
• Where: script.js

How to fix it

Paint text with Widget.dom.text, messages with Widget.dom.renderMessage and create elements with createElement. That way a viewer cannot inject HTML.

Wrong

box.innerHTML = `<b>${user}</b>`;

Right

const name = document.createElement("b");
Widget.dom.text(name, user);
box.append(name);