From 2c4948075cf41fcd9d11d4c4b06a072d8d1d0af5 Mon Sep 17 00:00:00 2001
From: Anastasia Gradova <anastasia.gradova@gsa.gov>
Date: Fri, 17 Jan 2025 08:37:13 -0700
Subject: [PATCH] Implimented ueid look js fix for security issue

---
 backend/static/js/check-ueid.js | 23 +++++++++++++++--------
 1 file changed, 15 insertions(+), 8 deletions(-)

diff --git a/backend/static/js/check-ueid.js b/backend/static/js/check-ueid.js
index 1f6841e279..f5e0b8fd03 100644
--- a/backend/static/js/check-ueid.js
+++ b/backend/static/js/check-ueid.js
@@ -44,14 +44,21 @@ function showValidUeiInfo() {
   const auditeeName = document.getElementById('auditee_name');
   const ueiInfoEl = document.createElement('div');
 
-  ueiInfoEl.innerHTML = `
-    <dl data-testid="uei-info">
-      <dt>Unique Entity ID</dt>
-      <dd>${auditeeUei}</dd>
-      <dt>Auditee name</dt>
-      <dd>${auditeeName.value}</dd>
-    </dl>
-  `;
+  let dl; let dtUei; let ddUei; let dtName; let ddName;
+  dl = document.createElement('dl');
+  dtUei = document.createElement('dt');
+  ddUei = document.createElement('dd');
+  dtName = document.createElement('dt');
+  ddName = document.createElement('dd');
+
+  dl.setAttribute('data-testid', 'uei-info');
+  dtUei.textContent = 'Unique Entity ID';
+  ddUei.textContent = auditeeUei;
+  dtName.textContent = 'Auditee name';
+  ddName.textContent = auditeeName.value;
+
+  dl.append(dtUei,ddUei,dtName,ddName);
+  ueiInfoEl.appendChild(dl);
 
   auditeeName.removeAttribute('disabled');
   auditeeName.parentNode.setAttribute('hidden', 'hidden');