ui: harden wizard upstream rendering

apps/ui/js/wizard.js

@@ -344,6 +344,22 @@ function updateUpstreamAuthUi() {
   updateAuthProfileCreateUi();
 }
 
+function buildUpstreamTriggerContent(name, url) {
+  var fragment = document.createDocumentFragment();
+  fragment.appendChild(createDivWithClass('upstream-trigger-name', name));
+  fragment.appendChild(createDivWithClass('upstream-trigger-url', url));
+  return fragment;
+}
+
+function setUpstreamComboboxPlaceholder(container) {
+  if (!container) return;
+  container.innerHTML = '';
+  var placeholder = document.createElement('span');
+  placeholder.className = 'upstream-combobox-placeholder';
+  placeholder.textContent = tKey('wizard.step2.upstream_placeholder');
+  container.appendChild(placeholder);
+}
+
 function renderDropdownList(filter) {
   var list = document.getElementById('upstream-dropdown-list');
   if (!list) return;
@@ -353,7 +369,11 @@ function renderDropdownList(filter) {
   });
 
   if (filtered.length === 0) {
-    list.innerHTML = '<div class="upstream-dropdown-empty">' + tfKey('agents.drawer.ops_no_match', { query: escapeHtml(filter) }) + '</div>';
+    list.innerHTML = '';
+    var empty = document.createElement('div');
+    empty.className = 'upstream-dropdown-empty';
+    empty.textContent = tfKey('agents.drawer.ops_no_match', { query: filter || '' });
+    list.appendChild(empty);
     return;
   }
 
@@ -428,9 +448,8 @@ function pickUpstream(id) {
       trigNode.querySelector('.upstream-trigger-url').textContent  = u.url;
       val.appendChild(trigNode);
     } else {
-      val.innerHTML =
-        '<div class="upstream-trigger-name">' + escapeHtml(u.name) + '</div>' +
-        '<div class="upstream-trigger-url">' + escapeHtml(u.url) + '</div>';
+      val.innerHTML = '';
+      val.appendChild(buildUpstreamTriggerContent(u.name, u.url));
     }
   }
 
@@ -477,7 +496,7 @@ function startNewUpstream() {
 
   // Clear combobox trigger & hide preview
   var val = document.getElementById('upstream-combobox-value');
-  if (val) val.innerHTML = '<span class="upstream-combobox-placeholder">' + tKey('wizard.step2.upstream_placeholder') + '</span>';
+  if (val) setUpstreamComboboxPlaceholder(val);
   var preview = document.getElementById('upstream-preview');
   if (preview) preview.style.display = 'none';
   selectedUpstreamId = null;
@@ -1889,9 +1908,8 @@ function prefillUpstream(baseUrl, headers, authProfileRef) {
 
   var valueEl = document.getElementById('upstream-combobox-value');
   if (valueEl) {
-    valueEl.innerHTML =
-      '<div class="upstream-trigger-name">imported-upstream</div>' +
-      '<div class="upstream-trigger-url">' + escapeHtml(baseUrl) + '</div>';
+    valueEl.innerHTML = '';
+    valueEl.appendChild(buildUpstreamTriggerContent('imported-upstream', baseUrl));
   }
 }