From ce1a99b7236e55c1757170eb7c8bb368309fc6ff Mon Sep 17 00:00:00 2001
From: kim <kim@applecherry.net>
Date: Sun, 5 Jul 2026 13:11:08 +0900
Subject: [PATCH] =?UTF-8?q?fix:=20=ED=88=AC=EC=9E=90=EC=95=B1=20=EC=B0=A8?=
 =?UTF-8?q?=ED=8A=B8=20=EB=A7=81=ED=81=AC=20onclick/=ED=85=8D=EC=8A=A4?=
 =?UTF-8?q?=ED=8A=B8=20=EC=9D=B4=EC=8A=A4=EC=BC=80=EC=9D=B4=ED=94=84=20?=
 =?UTF-8?q?=EC=B2=98=EB=A6=AC=20(XSS=20=EB=B0=A9=EC=A7=80)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 web-ui/investor-app.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/web-ui/investor-app.html b/web-ui/investor-app.html
index a69c582..c501be0 100644
--- a/web-ui/investor-app.html
+++ b/web-ui/investor-app.html
@@ -732,14 +732,14 @@ function renderMdSafe(text){
       const parts=body.trim().split('|');const code=parts[0].trim().replace(/\D/g,'');const period=(parts[1]||'day').trim().toLowerCase();
       if(!code)return m;
       const ph=`\x00CHART${charts.length}\x00`;
-      charts.push(`<span class="iv-chart-link" onclick="loadKStock('${code}','${code}','${period}')">📈 ${code} · ${period} 차트 보기</span>`);
+      charts.push(`<span class="iv-chart-link" onclick="loadKStock('${escAttr(code)}','${escAttr(code)}','${escAttr(period)}')">📈 ${escHtml(code)} · ${escHtml(period)} 차트 보기</span>`);
       return ph;
     })
     .replace(/```tradingview\s*\n([^`]+?)\n```/g,(m,body)=>{
       const parts=body.trim().split('|');const sym=parts[0].trim().toUpperCase();const iv=(parts[1]||'D').trim().toUpperCase();
       if(!sym)return m;
       const ph=`\x00CHART${charts.length}\x00`;
-      charts.push(`<span class="iv-chart-link" onclick="loadTV('${sym}','${iv}','${sym}')">📈 ${sym} · ${iv} 차트 보기</span>`);
+      charts.push(`<span class="iv-chart-link" onclick="loadTV('${escAttr(sym)}','${escAttr(iv)}','${escAttr(sym)}')">📈 ${escHtml(sym)} · ${escHtml(iv)} 차트 보기</span>`);
       return ph;
     });
   // HTML escape