ui: start template safety cleanup

apps/ui/js/api-keys.js

@@ -18,6 +18,16 @@ function tfKey(key, vars) {
   return window.tf ? tf(key, vars) : tKey(key);
 }
 
+function buildIconSvg(href, width, height) {
+  var svg = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
+  svg.setAttribute('width', String(width));
+  svg.setAttribute('height', String(height));
+  var use = document.createElementNS('http://www.w3.org/2000/svg', 'use');
+  use.setAttribute('href', href);
+  svg.appendChild(use);
+  return svg;
+}
+
 function mapKeyRecord(record) {
   var apiKey = record.api_key || {};
   return {
@@ -310,7 +320,13 @@ document.getElementById('copy-key-btn').addEventListener('click', function() {
   if (navigator.clipboard) {
     navigator.clipboard.writeText(value).catch(function() {});
   }
-  this.innerHTML = '<svg width="13" height="13"><use href="' + (window.APP_BASE || '') + 'icons/general/check.svg#icon"/></svg>';
+  this.replaceChildren(
+    buildIconSvg(
+      (window.APP_BASE || '') + 'icons/general/check.svg#icon',
+      13,
+      13
+    )
+  );
   if (window.CrankUi) {
     window.CrankUi.info(
       tKey('apikeys.toast.copy_message'),