优化

js/ticket-detail.js

@@ -48,7 +48,7 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
                 <div class="ticket-header">
                     <div>
                         <div class="section-kicker">Ticket Detail</div>
-                        <h1 class="ticket-title">${ticket.ticket_number || '-'} / ${ticket.customer_name || '-'}</h1>
+                        <h1 class="ticket-title">${escapeHtml(ticket.ticket_number || '-')} / ${escapeHtml(ticket.customer_name || '-')}</h1>
                         <p class="ticket-subtitle">单据全量信息、处理状态与打印操作在此统一展示。</p>
                     </div>
                     <div class="top-actions-group">
@@ -76,8 +76,8 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
         function item(label, value, extraClass = '', isHTML = false, isWide = false) {
             return `
                 <div class="detail-item${isWide ? ' wide' : ''}">
-                    <span class="detail-label">${label}</span>
-                    <div class="detail-value${extraClass ? ` ${extraClass}` : ''}">${isHTML ? value : (value || '无')}</div>
+                    <span class="detail-label">${escapeHtml(label)}</span>
+                    <div class="detail-value${extraClass ? ` ${escapeHtml(extraClass)}` : ''}">${isHTML ? value : escapeHtml(value || '无')}</div>
                 </div>
             `;
         }
@@ -94,7 +94,17 @@ const SUPABASE_URL = 'https://chixssrphfgxvqqigkzo.supabase.co';
         function showError(msg) {
             const el = document.getElementById('detailContent');
             el.classList.add('feedback-card');
-            el.innerHTML = `<div class="error-state">${msg}</div>`;
+            el.innerHTML = `<div class="error-state">${escapeHtml(msg)}</div>`;
+        }
+
+        function escapeHtml(value) {
+            return String(value ?? '').replace(/[&<>"']/g, char => ({
+                '&': '&amp;',
+                '<': '&lt;',
+                '>': '&gt;',
+                '"': '&quot;',
+                "'": '&#39;'
+            }[char]));
         }
 
         document.addEventListener('DOMContentLoaded', loadTicketDetail);